VB24 Mobile Security & Privacy Scorecard

by Victoriabank · iOS

81
Overall trust score
Trustworthy
78
Security
87
Privacy

Account activity and device data are processed by fraud detection and anti-tampering services (Wultra) to protect the user's session. Firebase is present but limited strictly to push notifications with analytics disabled. No data is shared with advertising or marketing networks.

Best for

Victoria Bank customers managing accounts on mobile

Findings

  • 0 critical
  • 3 high
  • 6 medium
  • 4 low
  • 7 info

3 issues identified across security and privacy analysis.

Top security issues

  • ATS globally disabled — all SDK and plugin HTTP traffic unprotected on any network
  • Session and CSRF tokens persist in UserDefaults uncleared after logout — post-session credential theft on jailbroken device
  • 3DS payment flow accepts postMessage without enforcing sender origin — crafted payment results injectable via redirect manipulation

Top privacy issues

  • Payment personalization key material (MMA encryptedKey + encryptionParams) stored in UserDefaults, accessible on jailbroken device
  • Always-on location permission requested for foreground-only ATM map — enables continuous background location tracking beyond stated purpose
  • Missing PrivacyInfo.xcprivacy despite active NSUserDefaults and Firebase usage — App Store privacy labels unverifiable

Full analysis

VictoriaBank VB24 Mobile

What This Means for You

Your banking sessions are protected by biometric login and built-in fraud detection, but the app's network settings allow third-party tools to communicate over unencrypted channels, which can expose your activity on public Wi-Fi.

Recommendation: Use With Caution

The app includes strong protective measures including biometric authentication and active fraud detection that monitors for tampering and suspicious device states. However, the app does not enforce encrypted connections for all outbound traffic, meaning analytics and plugin services could transmit data over unprotected channels on untrusted networks. Routine banking on trusted home or corporate networks is low risk; exercise caution on public Wi-Fi or shared networks.

Best For: VictoriaBank customers who need mobile banking access and are comfortable with standard device security practices

Key Findings

Data Security - 4 findings (3 medium, 1 info)

Network Security - 5 findings (1 high, 2 medium, 2 info)

Code Safety - 5 findings (4 low, 1 info)

Privacy - 3 findings (1 medium, 2 info)

Privacy Concerns

What Data is Collected

  • Account and banking information: account details, session data, payment credentials
  • Device information: device integrity signals, security state, installed app presence, VPN and proxy status (collected for fraud detection)
  • Location data: used for ATM and branch map display
  • Contact information: contacts access declared in app permissions
  • Photos: photo library access declared in app permissions
  • Payment card information: card details captured via camera scanning

Third-Party Data Sharing

The following third parties may receive your data:

  • Firebase (Google) - push notification delivery only; analytics and advertising are disabled
  • Wultra AppProtection - device security signals sent to Wultra's fraud detection infrastructure (screen capture, VPN, proxy, and tampering detection)
  • Wultra Malwarelytics - device integrity monitoring for banking fraud prevention
  • OpenWay (MMA / Apple Wallet) - payment credential generation and Apple Wallet card provisioning
  • CardIO - payment card camera scanning (card number recognition)

Understanding the Scores

Security: 78/100
Privacy: 87/100

Security Breakdown

  • Data Security: 76/100 - Session data is not fully cleared on logout and some secure storage settings use older configurations
  • Network Security: 70/100 - Encrypted connection enforcement is globally disabled, allowing third-party services to use unencrypted channels
  • Code Safety: 95/100 - Strong runtime protection and standard security frameworks in use throughout

Privacy Breakdown

  • Data Collection: 25/100 - Multiple permission categories are declared, and fraud detection collects broad device signals including app presence and call status
  • Data Sharing: 100/100 - Third-party data sharing is limited to functional services with no advertising or tracking partners identified
  • User Control: 91/100 - Biometric authentication and session management give users strong control over account access

Positive Security Features

  • Biometric-protected secure storage using native iOS security frameworks and cryptographically strong key generation
  • Comprehensive fraud detection and runtime protection monitoring for tampering, screen capture, proxy interception, and remote access tools
  • Firebase analytics fully disabled - Firebase is used only for push notifications with no ad tracking or behavioral profiling
  • External links open in Safari with a full address bar rather than in a hidden in-app browser, limiting access to sensitive app functions
  • Universal Links correctly configured for deep link routing, providing server-verified link handling

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

  1. Completing the Privacy Manifest
    The app's privacy declaration file is missing despite active use of system storage and push notification services. Adding a complete manifest would ensure App Store privacy labels accurately reflect actual data usage.

  2. Narrowing Location Permission Scope
    The app requests always-on location access for a feature (ATM map) that only needs location when the app is open. Limiting this to while-in-use permission would prevent unintended background location collection.

  3. Clarifying Permission Explanations
    The descriptions shown to users when requesting contacts, calendar, and photo access use generic placeholder text. Specific explanations of why each permission is needed would help users make informed decisions.

Security Enhancements

  1. Clearing Session Data on Logout
    Signing out should remove all session information from device storage. Currently some session data persists after logout, which could be accessed if the device is later shared or compromised.

  2. Tightening Navigation Permissions
    The app currently permits navigation to any web address over both encrypted and unencrypted connections. Restricting this to a specific list of trusted domains would reduce exposure to crafted or redirected web content.

  3. Using a Dedicated Deep Link Scheme
    Registering a unique URL scheme for handling incoming links to the app would prevent other installed apps from sending crafted navigation requests to the banking app.

Technical Context

App Type: Mobile banking application - financial, high sensitivity
Classes Analyzed: iOS binary and JavaScript bundle analysis
Third-Party Services: 8 identified
Context Tags: financial, sensitive_data, location, contacts, camera, biometric

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: VictoriaBank
Version: 1.5.5885 (Build 1)
Analysis Date: 2026-04-17
Package: md.victoriabank.mobilebank

Analysis Limitations

  • Static analysis only (code review without running the app)
  • Based on IPA version 1.5.5885 analyzed on 2026-04-17
  • May not reflect server-side security controls
  • Cannot detect all runtime behaviors

Versions & scan history

ScanDateOverall score
#2 (current) 81/100