Scan results

Recommendation: Use With Caution

The app includes strong protective measures including biometric authentication and active fraud detection that monitors for tampering and suspicious device states. However, the app does not enforce encrypted connections for all outbound traffic, meaning analytics and plugin services could transmit data over unprotected channels on untrusted networks. Routine banking on trusted home or corporate networks is low risk; exercise caution on public Wi-Fi or shared networks.

Key Findings

Data Security - 4 findings (3 medium, 1 info)

Network Security - 5 findings (1 high, 2 medium, 2 info)

Code Safety - 5 findings (4 low, 1 info)

Privacy - 3 findings (1 medium, 2 info)

Privacy Concerns

What Data is Collected

• Account and banking information: account details, session data, payment credentials
• Device information: device integrity signals, security state, installed app presence, VPN and proxy status (collected for fraud detection)
• Location data: used for ATM and branch map display
• Contact information: contacts access declared in app permissions
• Photos: photo library access declared in app permissions
• Payment card information: card details captured via camera scanning

Third-Party Data Sharing

The following third parties may receive your data:

• Firebase (Google) - push notification delivery only; analytics and advertising are disabled
• Wultra AppProtection - device security signals sent to Wultra's fraud detection infrastructure (screen capture, VPN, proxy, and tampering detection)
• Wultra Malwarelytics - device integrity monitoring for banking fraud prevention
• OpenWay (MMA / Apple Wallet) - payment credential generation and Apple Wallet card provisioning
• CardIO - payment card camera scanning (card number recognition)

Understanding the Scores

Security: 78/100
Privacy: 87/100

Security Breakdown

• Data Security: 76/100 - Session data is not fully cleared on logout and some secure storage settings use older configurations
• Network Security: 70/100 - Encrypted connection enforcement is globally disabled, allowing third-party services to use unencrypted channels
• Code Safety: 95/100 - Strong runtime protection and standard security frameworks in use throughout

Privacy Breakdown

• Data Collection: 25/100 - Multiple permission categories are declared, and fraud detection collects broad device signals including app presence and call status
• Data Sharing: 100/100 - Third-party data sharing is limited to functional services with no advertising or tracking partners identified
• User Control: 91/100 - Biometric authentication and session management give users strong control over account access

Positive Security Features

• Biometric-protected secure storage using native iOS security frameworks and cryptographically strong key generation
• Comprehensive fraud detection and runtime protection monitoring for tampering, screen capture, proxy interception, and remote access tools
• Firebase analytics fully disabled - Firebase is used only for push notifications with no ad tracking or behavioral profiling
• External links open in Safari with a full address bar rather than in a hidden in-app browser, limiting access to sensitive app functions
• Universal Links correctly configured for deep link routing, providing server-verified link handling

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Completing the Privacy Manifest
   The app's privacy declaration file is missing despite active use of system storage and push notification services. Adding a complete manifest would ensure App Store privacy labels accurately reflect actual data usage.

2. Narrowing Location Permission Scope
   The app requests always-on location access for a feature (ATM map) that only needs location when the app is open. Limiting this to while-in-use permission would prevent unintended background location collection.

3. Clarifying Permission Explanations
   The descriptions shown to users when requesting contacts, calendar, and photo access use generic placeholder text. Specific explanations of why each permission is needed would help users make informed decisions.

Security Enhancements

1. Clearing Session Data on Logout
   Signing out should remove all session information from device storage. Currently some session data persists after logout, which could be accessed if the device is later shared or compromised.

2. Tightening Navigation Permissions
   The app currently permits navigation to any web address over both encrypted and unencrypted connections. Restricting this to a specific list of trusted domains would reduce exposure to crafted or redirected web content.

3. Using a Dedicated Deep Link Scheme
   Registering a unique URL scheme for handling incoming links to the app would prevent other installed apps from sending crafted navigation requests to the banking app.

Technical Context

App Type: Mobile banking application - financial, high sensitivity
Classes Analyzed: iOS binary and JavaScript bundle analysis
Third-Party Services: 8 identified
Context Tags: financial, sensitive_data, location, contacts, camera, biometric

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: VictoriaBank
Version: 1.5.5885 (Build 1)
Analysis Date: 2026-04-17
Package: md.victoriabank.mobilebank

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on IPA version 1.5.5885 analyzed on 2026-04-17
• May not reflect server-side security controls
• Cannot detect all runtime behaviors