RBC Mobile Security & Privacy Scorecard
Android
User activity is tracked by Firebase, Google Analytics, and AppsFlyer, sharing behavioral data with multiple third parties. Account interactions and device information are monitored by fraud-detection and analytics services. Users have limited ability to opt out of this data collection.
Best for
RBC customers who need mobile banking access
Avoid if
You want full control over how your data is used
Findings
- 7 critical
- 7 high
- 10 medium
- 2 low
- 0 info
0 issues identified across security and privacy analysis.
Top security issues
- SSL Certificate Validation Bypass in WebView Implementations
- Service Logs Written to Public External Storage
- JavaScript Interface Remote Code Execution Vectors
Top privacy issues
- Analytics Tracking Without User Consent
- Dynatrace Network Payload Interception Risk
- Hashed Customer ID (SRF) Sent to Firebase Analytics
Full analysis
RBC Mobile
Version: 4.59.1 | Scan Date: January 31, 2026
What This Means for You
User activity is tracked by Firebase, Google Analytics, and AppsFlyer, sharing behavioral data with multiple third parties. Account interactions and device information are monitored by fraud-detection and analytics services. Users have limited ability to opt out of this data collection.
Recommendation: Use With Caution
Best For: RBC customers who need mobile banking access
Avoid If: You want full control over how your data is used
Key Findings
Data Security - 8 findings (1 critical, 3 high, 2 medium, 2 low)
Network Security - 2 findings (1 critical, 1 medium)
Code Safety - 0 findings
Privacy - 9 findings (2 critical, 3 high, 4 medium)
Privacy Concerns
What Data is Collected
RBC Mobile collects account activity, device identifiers, and behavioral patterns. Fraud-detection services monitor how users navigate and interact within the app. Analytics platforms record in-app actions to build usage profiles that extend beyond basic banking functions.
Third-Party Data Sharing
User data is shared with Firebase, Google Analytics, AppsFlyer, ThreatMetrix, Dynatrace, DevCycle, and LivePerson. Several of these are advertising and behavioral analytics platforms that may use that information for purposes beyond operating the app.
Understanding the Scores
| Category | Score |
|---|---|
| Security | 45/100 |
| Privacy | 35/100 |
| Data Security | 50/100 |
| Network Security | 40/100 |
| Code Safety | 55/100 |
| Data Collection | 30/100 |
| Data Sharing | 25/100 |
| User Control | 20/100 |
Positive Security Features
No standout positive security practices were identified in this version of the app.
Areas for Improvement
- Behavioral and device data is shared with a large number of third-party services, including advertising and profiling platforms that go beyond what is needed for banking.
- The app provides very limited controls to restrict or opt out of third-party data collection and sharing.
- Data collection scope extends into behavioral profiling, meaning in-app patterns may be analyzed by parties outside of RBC.
About This Analysis
This scorecard is based on automated static analysis of the app binary. Scores reflect the security and privacy posture observed at the time of the scan and may change as the app is updated.
App Details
- App Name: RBC Mobile
- Package ID: com.rbc.mobile.android
- Version: 4.59.1
- Platform: Android
- Scan Date: January 31, 2026
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 40/100 |