CITT

    Scan results

    Mobile Banking UniCredit

    Android

    Mobile Banking UniCredit app enables easy, fast and secure transactions for UniCredit account holders. Features biometric authentication, expense management, payment capabilities, and support for account management. Requires UniCredit account activation via Banca Multicanale Service.

    CITT SCORE
    38
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: UniCredit customers who need everyday mobile banking

    Not For: You want control over how your data is used for marketing

    What It Means For You

    In-app activity is shared with Adobe Marketing Cloud alongside standard analytics services, meaning banking behavior informs marketing profiles. Users have very limited options to restrict or opt out of this data collection. Multiple third-party services monitor sessions, and the ability to manage what gets shared is among the lowest seen in banking apps.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (15)

    Data Security

    6 total
    1 Critical
    1 High
    4 Medium

    Network Security

    2 total
    2 Medium

    Code Security

    2 total
    1 High
    1 Medium

    Privacy

    5 total
    2 Critical
    2 High
    1 Medium

    Third-Party Services

    Catapush, Firebase Cloud Messaging, Huawei HMS Push Kit, Adobe Marketing Cloud, Dynatrace APM, LivePerson, ThreatMark, Scanbot SDK, Google Pay, Samsung Pay, Reply Payment SDK

    Security Strengths

    • ✓AES-256-GCM database encryption for LivePerson chat with Android Keystore
    • ✓Certificate pinning for ThreatMark fraud detection API
    • ✓Backup disabled (allowBackup=false) prevents ADB extraction
    • ✓Debug mode disabled in production builds
    • ✓HTTPS enforcement (usesCleartextTraffic=false)
    • ✓Biometric authentication implemented
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    banking
    sensitive data
    location
    behavioral tracking
    biometric
    gdpr violations
    phishing risk

    Package

    com.unicredit

    Version

    3.68.1 (Build 36801001)

    Analysis Date

    Feb 8, 2026

    Classes Analyzed

    26,173

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 6 findings (1 critical, 1 high, 4 medium)

    Network Security - 2 findings (2 medium)

    Code Safety - 0 findings

    Privacy - 5 findings (2 critical, 2 high, 1 medium)

    Privacy Concerns

    What Data is Collected

    This app collects behavioral and session data during banking activity. Analytics and monitoring services record how users navigate the app, time spent on screens, and patterns in usage. This information is retained by both the bank and third-party services.

    Third-Party Data Sharing

    Data is shared with the following third-party services:

    • Catapush - push notification delivery
    • Firebase Cloud Messaging - push notification delivery
    • Huawei HMS Push Kit - push notification delivery
    • Adobe Marketing Cloud - marketing analytics and behavioral profiling
    • Dynatrace APM - application performance monitoring
    • LivePerson - in-app customer support
    • ThreatMark - fraud and behavioral analysis
    • Scanbot SDK - document scanning
    • Google Pay - payment processing
    • Samsung Pay - payment processing
    • Reply Payment SDK - payment processing

    Understanding the Scores

    CategoryScore
    Overall Security45/100
    Overall Privacy30/100
    Data Security50/100
    Network Security75/100
    Code Safety55/100
    Data Collection35/100
    Data Sharing40/100
    User Control25/100

    Positive Security Features

    • None identified for this version.

    Areas for Improvement

    • The app shares user activity data with advertising and marketing platforms, leaving users with little ability to limit what is collected or passed on.
    • Multiple third-party services monitor user sessions with no clear opt-out provided within the app.
    • The level of control users have over their data is significantly lower than what is typical among comparable apps.

    About This Analysis

    This scorecard is based on static analysis of the app binary. Scores reflect findings at the time of the scan and may change with app updates.

    App Details

    FieldValue
    App NameMobile Banking UniCredit
    Package IDcom.unicredit
    Version3.68.1 (Build 36801001)
    Scan Date2026-02-08

    Right of Reply

    Developer not yet contacted