CITT

    Scan results

    Scotiabank Mobile Banking

    Android

    Scotiabank's mobile banking app enables secure account management with budgeting tools, mobile cheque deposit, 2-step verification, and accessibility features. It offers personalized financial insights, rewards redemption, credit monitoring, and advisor access with data encryption for transaction se

    CITT SCORE
    80
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Scotiabank customers banking on the go

    What It Means For You

    Device behavior and session activity is analyzed by fraud-detection services to verify identity. Adobe and Firebase collect usage data, and interactions are monitored to personalize the in-app experience. Integrated third parties include Interac, Western Union, and TransUnion for financial features.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (9)

    Network Security

    2 total
    2 Info

    Code Security

    4 total
    1 High
    2 Medium
    1 Low

    Privacy

    3 total
    1 High
    1 Medium
    1 Low

    Third-Party Services

    Akamai Bot Manager, BioCatch, ThreatMetrix, Adobe Experience Cloud, Firebase, LaunchDarkly, Medallia Digital, Personetics, Acuant, Top Image Systems, OpenCV, Google ML Kit, Samsung Pay SDK, OneTrust, Western Union, Interac, TransUnion, Scene+

    Security Strengths

    • ✓Certificate pinning on 6 critical authentication domains
    • ✓AES-256-GCM encryption with Android KeyStore hardware-backed keys
    • ✓Session tokens stored in memory only (never persisted to disk)
    • ✓HTTPS enforcement with cleartext traffic disabled
    • ✓Modern TLS 1.2+ with strong cipher suites
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    biometrics
    location
    camera
    contacts
    behavioral tracking

    Package

    com.scotiabank.banking

    Version

    2508.0.0 (versionCode: 212)

    Analysis Date

    Feb 16, 2026

    Classes Analyzed

    45,939

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Trustworthy

    Key Findings

    Data Security - 0 findings

    Network Security - 2 findings (2 info)

    Code Safety - 0 findings

    Privacy - 3 findings (1 high, 1 medium, 1 low)

    Privacy Concerns

    What Data is Collected

    The app collects behavioral signals from the device, including touch patterns, typing rhythm, and session timing, to support fraud detection and identity verification. Usage analytics are gathered by Adobe Experience Cloud and Firebase, covering screens visited, features used, and session duration. Device identifiers and interaction history may also be retained to personalize the in-app experience.

    Third-Party Data Sharing

    BioCatch and ThreatMetrix receive behavioral and device signals to assess fraud risk during sessions. Adobe Experience Cloud and Firebase receive usage and interaction data for analytics and personalization. Acuant and Top Image Systems receive document images to support identity verification flows. Western Union, Interac, and TransUnion receive financial data to facilitate transfers, payments, and credit-related features. Scene+ and Personetics receive transaction and preference data to support rewards and financial insights. OneTrust is used for consent and privacy preference management.

    Understanding the Scores

    CategoryScore
    Security82/100
    Privacy78/100
    Data Security85/100
    Network Security98/100
    Code Safety80/100
    Data Collection75/100
    Data Sharing90/100
    User Control82/100

    Positive Security Features

    • Network communication received a near-perfect score of 98/100, reflecting strong practices for protecting data as it travels between the device and the bank's servers.

    Areas for Improvement

    • Multiple behavioral profiling services monitor how users interact with the device. Reviewing the app's privacy settings and the linked privacy policy can help users understand what is retained and for how long.
    • Third-party analytics services receive data about in-app activity, which may contribute to profiles of banking behavior beyond what is needed for core app functionality.
    • The range of identity and financial data shared with services such as TransUnion warrants a closer look at the consent options available within the app's settings.

    About This Analysis

    This scorecard is produced through automated analysis of the app's code and configuration. Scores and findings reflect the security and privacy posture of the version examined and may change as the app is updated.

    App Details

    • Package ID: com.scotiabank.banking
    • Version: 2508.0.0 (build 212)
    • Platform: Android
    • Scan Date: February 16, 2026

    Right of Reply

    Developer not yet contacted