CITT

    Scan results

    YONO SBI: Banking & Lifestyle

    Android

    YONO SBI is State Bank of India's all-in-one digital banking app offering seamless payments, UPI transfers, bill payments, account management, and investment services with 100M+ downloads and a 4.1-star rating.

    CITT SCORE
    28
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: SBI customers needing mobile banking access

    Not For: Those unwilling to share banking data with ad networks

    What It Means For You

    Banking activity and usage patterns are tracked via Firebase Analytics, and a Google Ads SDK is present, meaning users' financial behavior can influence the ads shown to them elsewhere. Financial data is handled with weaker protections than most banking apps. Users have limited ability to control what is collected or shared.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (24)

    Data Security

    8 total
    2 Critical
    2 High
    4 Medium

    Network Security

    1 total
    1 Medium

    Code Security

    7 total
    2 Critical
    2 High
    3 Medium

    Privacy

    5 total
    1 Critical
    1 High
    3 Medium

    Third-Party Risk

    1 total
    1 Medium

    Permission Usage

    2 total
    1 High
    1 Medium

    Third-Party Services

    Firebase Analytics, Firebase Cloud Messaging, Google Ads SDK, IBM MobileFirst Platform, Google Maps API, Google Sign-In, NPCI UPI SDK

    Security Strengths

    • ✓Root detection with automatic app exit
    • ✓Certificate pinning (OkHttp + MobileFirst)
    • ✓Heavy code obfuscation (ProGuard/R8)
    • ✓Backup disabled (allowBackup=false)
    • ✓HTTPS enforced (usesCleartextTraffic=false)
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    banking
    sensitive data
    location
    sms
    contacts
    ads
    analytics

    Package

    com.sbi.lotusintouch

    Version

    2.27.04 (Build 1241110)

    Analysis Date

    Jan 24, 2026

    0

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 8 findings (2 critical, 2 high, 4 medium)

    Network Security - 1 finding (1 medium)

    Code Safety - 0 findings

    Privacy - 5 findings (1 critical, 1 high, 3 medium)

    Privacy Concerns

    What Data is Collected

    Device identifiers, location data, and in-app activity patterns are collected. This includes how users navigate the app, when they use it, and details about their device and network connection.

    Third-Party Data Sharing

    User data is shared with the following third-party services:

    • Firebase Analytics - Behavioral and usage tracking
    • Google Ads SDK - Advertising and behavioral profiling
    • Firebase Cloud Messaging - Push notification delivery
    • IBM MobileFirst Platform - Mobile application backend services
    • Google Maps API - Location services
    • Google Sign-In - Authentication services
    • NPCI UPI SDK - Payment processing infrastructure

    Understanding the Scores

    CategoryScore
    Security25/100
    Privacy30/100
    Data Security20/100
    Network Security55/100
    Code Safety30/100
    Data Collection35/100
    Data Sharing40/100
    User Control25/100

    Positive Security Features

    • None identified in this version.

    Areas for Improvement

    • Financial activity data is shared with advertising networks. For a banking app, this means spending patterns and financial behaviors may be used to target ads shown to users elsewhere.
    • Data protections for stored financial information fall below what is typically expected from banking apps, placing personal financial data at greater risk.
    • Users have very limited ability to opt out of data collection or sharing, leaving them with little meaningful control over their financial information.

    About This Analysis

    This scorecard reflects the app's observable security and privacy practices based on analysis of version 2.27.04. Scores are on a 0-100 scale, where higher is better.

    App Details

    • App: YONO SBI: Banking & Lifestyle
    • Package: com.sbi.lotusintouch
    • Version: 2.27.04 (Build 1241110)
    • Scan Date: 2026-01-24

    Right of Reply

    Developer not yet contacted