CITT

    Scan results

    TodoPago

    Android

    TodoPago is a payment and commerce platform combining bill payments (utilities, taxes), merchant services, and marketplace ordering. It supports QR code merchant payments and card applications.

    CITT SCORE
    28
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: TodoPago users aware of broad data sharing

    Not For: You store sensitive financial data on shared devices

    What It Means For You

    Payment activity and device identifiers are shared with multiple analytics and identity verification services. Firebase tracks app behavior, while Kount and Metamap process identity and transaction data for fraud detection. Financial interactions are handled with weaker-than-expected data protections in place.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (27)

    Data Security

    9 total
    5 Critical
    3 High
    1 Medium

    Network Security

    2 total
    2 Critical

    Code Security

    7 total
    2 Critical
    2 Medium
    3 Low

    Privacy

    6 total
    1 Critical
    2 High
    2 Medium
    1 Low

    Third-Party Risk

    2 total
    2 High

    Permission Usage

    1 total
    1 Medium

    Third-Party Services

    Kount Analytics, Metamap SDK, Incode Welcome SDK, Firebase (Analytics, Crashlytics, Messaging), Huawei HMS, Google Play Services, Card.io

    Security Strengths

    • ✓Backup disabled (android:allowBackup=false)
    • ✓Android KeyStore for biometric authentication
    • ✓MODE_PRIVATE SharedPreferences (process isolation)
    • ✓Incode SDK implements SSL pinning
    • ✓File access disabled in WebViews
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    location
    camera
    ads

    Package

    com.mobilcash.todomovil

    Version

    3.4 (Build 66)

    Analysis Date

    Feb 16, 2026

    Classes Analyzed

    23,895

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 9 findings (5 critical, 3 high, 1 medium)

    Network Security - 2 findings (2 critical)

    Code Safety - 0 findings

    Privacy - 6 findings (1 critical, 2 high, 2 medium, 1 low)

    Privacy Concerns

    What Data is Collected

    TodoPago collects device identifiers, payment transaction data, and behavioral activity within the app. User identity details are processed through third-party services for fraud detection and onboarding verification purposes.

    Third-Party Data Sharing

    User data is shared with the following third-party services:

    • Firebase (Analytics, Crashlytics, Messaging) - Behavioral tracking, crash reporting, and push notifications
    • Kount Analytics - Fraud detection and transaction risk scoring
    • Metamap SDK - Identity verification processing
    • Incode Welcome SDK - Onboarding and identity checks
    • Huawei HMS - Device platform integration
    • Google Play Services - Core platform services
    • Card.io - Payment card scanning

    Understanding the Scores

    CategoryScore
    Security25/100
    Privacy30/100
    Data Security20/100
    Network Security25/100
    Code Safety35/100
    Data Collection40/100
    Data Sharing45/100
    User Control35/100

    Positive Security Features

    • This version of the app does not demonstrate standout security practices based on what was observed.

    Areas for Improvement

    • Stronger protections should be applied to how payment and identity data is stored and transmitted within the app.
    • The range of third-party services that access user financial and identity data should be reduced to limit unnecessary exposure.
    • Users should be given clearer controls over what data is collected and which external parties receive it.

    About This Analysis

    This scorecard is based on static analysis of the app's code and configuration. Scores reflect the security and privacy posture observed at the time of the scan.

    App Details

    • App Name: TodoPago
    • Package ID: com.mobilcash.todomovil
    • Version: 3.4 (Build 66)
    • Scan Date: 2026-02-16
    • Platform: Android

    Right of Reply

    Developer not yet contacted