CITT

    Scan results

    RBC Mobile

    Android

    Mobile banking app by Royal Bank of Canada offering account management, transfers, bill payments, and cheque deposits with biometric authentication. Includes AI-powered financial insights via NOMI.

    CITT SCORE
    40
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: RBC customers who need mobile banking access

    Not For: You want full control over how your data is used

    What It Means For You

    User activity is tracked by Firebase, Google Analytics, and AppsFlyer, sharing behavioral data with multiple third parties. Account interactions and device information are monitored by fraud-detection and analytics services. Users have limited ability to opt out of this data collection.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (22)

    Data Security

    8 total
    1 Critical
    3 High
    2 Medium
    2 Low

    Network Security

    2 total
    1 Critical
    1 Medium

    Code Security

    3 total
    1 Critical
    2 Medium

    Privacy

    9 total
    2 Critical
    3 High
    4 Medium

    Third-Party Services

    Firebase, Dynatrace, AppsFlyer, ThreatMetrix, DevCycle, LivePerson, Google Analytics

    Security Strengths

    • ✓AES-256-GCM encryption with Android Keystore
    • ✓OAuth tokens never persisted (in-memory only)
    • ✓Strong cryptography implementation
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    banking
    sensitive data
    location
    camera
    contacts
    ads

    Package

    com.rbc.mobile.android

    Version

    4.59.1

    Analysis Date

    Jan 31, 2026

    Classes Analyzed

    43,073

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 8 findings (1 critical, 3 high, 2 medium, 2 low)

    Network Security - 2 findings (1 critical, 1 medium)

    Code Safety - 0 findings

    Privacy - 9 findings (2 critical, 3 high, 4 medium)

    Privacy Concerns

    What Data is Collected

    RBC Mobile collects account activity, device identifiers, and behavioral patterns. Fraud-detection services monitor how users navigate and interact within the app. Analytics platforms record in-app actions to build usage profiles that extend beyond basic banking functions.

    Third-Party Data Sharing

    User data is shared with Firebase, Google Analytics, AppsFlyer, ThreatMetrix, Dynatrace, DevCycle, and LivePerson. Several of these are advertising and behavioral analytics platforms that may use that information for purposes beyond operating the app.

    Understanding the Scores

    CategoryScore
    Security45/100
    Privacy35/100
    Data Security50/100
    Network Security40/100
    Code Safety55/100
    Data Collection30/100
    Data Sharing25/100
    User Control20/100

    Positive Security Features

    No standout positive security practices were identified in this version of the app.

    Areas for Improvement

    • Behavioral and device data is shared with a large number of third-party services, including advertising and profiling platforms that go beyond what is needed for banking.
    • The app provides very limited controls to restrict or opt out of third-party data collection and sharing.
    • Data collection scope extends into behavioral profiling, meaning in-app patterns may be analyzed by parties outside of RBC.

    About This Analysis

    This scorecard is based on automated static analysis of the app binary. Scores reflect the security and privacy posture observed at the time of the scan and may change as the app is updated.

    App Details

    • App Name: RBC Mobile
    • Package ID: com.rbc.mobile.android
    • Version: 4.59.1
    • Platform: Android
    • Scan Date: January 31, 2026

    Right of Reply

    Developer not yet contacted