CITT

    Scan results

    Banca Móvil BAC

    Android

    Banca Móvil BAC is a banking app by BAC Credomatic Network that allows users to check account balances, transfer money, pay bills, make cardless withdrawals, and manage investments and loans from their mobile device.

    CITT SCORE
    40
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: BAC customers comfortable with analytics sharing

    What It Means For You

    App usage and behavior is shared with Firebase Analytics and AppsFlyer, meaning banking interactions feed marketing and attribution platforms. Revelock and Facephi collect biometric and behavioral data to verify user identity. User activity is also monitored by New Relic and Medallia for performance and feedback purposes.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (16)

    Data Security

    7 total
    1 Critical
    4 High
    2 Medium

    Network Security

    1 total
    1 High

    Code Security

    6 total
    1 Critical
    2 High
    3 Medium

    Privacy

    2 total
    1 Critical
    1 High

    Third-Party Services

    Thales Digital Banking Platform, IBM MobileFirst, Revelock/BioCatch, Facephi, Microblink BlinkID, Firebase Analytics, AppsFlyer, New Relic, Medallia, Google ML Kit

    Security Strengths

    • ✓99.8% code obfuscation (2,278 of 2,282 classes)
    • ✓APK Defender anti-tampering protection (11 MB library)
    • ✓Tokenized payments via Thales (PCI-DSS compliant, no card numbers stored)
    • ✓Android Keystore used for biometric key storage
    • ✓Multi-factor authentication (OAuth, biometric, CBAC, OTP)
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    banking
    sensitive data
    biometrics
    location
    contacts
    camera
    payments
    behavioral tracking

    Package

    net.bac.sbe.android

    Version

    5.50.2 (Build 53055002)

    Analysis Date

    Feb 9, 2026

    Classes Analyzed

    2,282

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 7 findings (1 critical, 4 high, 2 medium)

    Network Security - 1 finding (1 high)

    Code Safety - 0 findings

    Privacy - 2 findings (1 critical, 1 high)

    Privacy Concerns

    What Data is Collected

    Banca Móvil BAC collects behavioral patterns, biometric data, device identifiers, and app usage activity. Microblink BlinkID processes identity document images during onboarding. Facephi and Revelock/BioCatch collect biometric and behavioral signals continuously to verify user identity.

    Third-Party Data Sharing

    User data is shared with multiple third-party platforms:

    • Firebase Analytics - receives in-app behavior and session data
    • AppsFlyer - receives attribution and marketing data tied to user activity
    • Revelock/BioCatch - receives behavioral biometrics for identity verification
    • Facephi - receives biometric data for authentication
    • New Relic - receives performance and diagnostic data
    • Medallia - receives feedback and experience data
    • Microblink BlinkID - processes identity document images
    • Google ML Kit - processes on-device data for additional functionality
    • Thales Digital Banking Platform - provides core banking infrastructure
    • IBM MobileFirst - provides mobile platform services

    Understanding the Scores

    CategoryScore
    Security45/100
    Privacy35/100
    Data Security50/100
    Network Security75/100
    Code Safety55/100
    Data Collection30/100
    Data Sharing70/100
    User Control40/100

    Positive Security Features

    • Biometric identity verification through Facephi and Revelock/BioCatch adds a meaningful layer of protection for account access
    • Network communications scored relatively well, indicating basic transport protections are in place
    • Document identity verification via Microblink BlinkID supports more secure account onboarding

    Areas for Improvement

    • Banking activity is collected by multiple analytics and marketing platforms, with limited transparency about how long that data is retained or how it is used beyond its stated purpose.
    • Biometric and behavioral data collection by third parties warrants clearer disclosure and stronger controls over what data is shared and when.
    • The low User Control score (40/100) reflects limited options for managing or limiting what information is passed to third-party services.

    About This Analysis

    This scorecard is based on automated static analysis of version 5.50.2 of the published app.

    App Details

    • App Name: Banca Móvil BAC
    • Package ID: net.bac.sbe.android
    • Version: 5.50.2 (Build 53055002)
    • Scan Date: 2026-02-09
    • Platform: Android

    Right of Reply

    Developer not yet contacted