CITT

    Scan results

    Rabobank

    iOS

    Rabobank's primary mobile banking app for Dutch customers. Provides account management, payments, iDEAL transfers, identity verification via NFC and biometric authentication.

    CITT SCORE
    91
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Rabobank customers managing daily finances

    What It Means For You

    App usage and interactions are measured by Piano Analytics, Google Analytics, and BlueConic, which can build a profile of how users navigate the banking app. Third-party services including Tealium and Split.io also receive data about user sessions. Identity verification involves iProov and Thales ReadID, which process biometric and document data during onboarding.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (15)

    Data Security

    6 total
    1 Medium
    4 Low
    1 Info

    Network Security

    3 total
    3 Info

    Code Security

    4 total
    1 Medium
    3 Low

    Privacy

    2 total
    1 Medium
    1 Info

    Third-Party Services

    ThreatFabric FRSMobileSDK, ThreatFabric CsdIosClient, iProov, ReadID_UI (Thales), Split.io, Piano Analytics, PianoConsents, PLCrashReporter, Usabilla, BlueConic, Tealium, Google Analytics, Swinject

    Security Strengths

    • ✓ATS certificate pinning with 9 SPKI-SHA256 CA pins covering all *.rabobank.nl subdomains
    • ✓mTLS client certificate authentication for ThreatFabric fraud detection endpoints
    • ✓Biometric-bound Secure Enclave EC key pairs for PSD2 dynamic linking transaction signing
    • ✓GDPR consent-gated analytics via PianoConsents with PrivacyStep gating
    • ✓Comprehensive app-level privacy manifest accurately declaring all major data categories
    • ✓29-host navigation allowlist enforced natively in WebView to prevent bridge abuse
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    biometric
    location
    contacts
    nfc
    identity verification

    Package

    nl.Rabobank.Bankieren

    Version

    7.55.1 (build 202603241044)

    Analysis Date

    Apr 9, 2026

    0

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on App Store

    Recommendation: Trustworthy

    Key Findings

    Data Security - 6 findings (1 medium, 4 low, 1 info)

    Network Security - 3 findings (3 info)

    Code Safety - 0 findings

    Privacy - 2 findings (1 medium, 1 info)

    Privacy Concerns

    What Data is Collected

    The app collects behavioral and usage data through Piano Analytics, Google Analytics, and BlueConic, which track how users navigate and interact with banking features. Crash and performance data is gathered through PLCrashReporter. Feedback and in-app survey responses are collected via Usabilla.

    Third-Party Data Sharing

    Tealium, a data management platform, coordinates data flows between the app and multiple analytics partners. Split.io receives information about user sessions for feature experimentation. iProov and Thales ReadID process biometric and identity document data during account verification and onboarding.

    Understanding the Scores

    CategoryScore
    Security91/100
    Privacy91/100
    Data Security92/100
    Network Security98/100
    Code Safety94/100
    Data Collection91/100
    Data Sharing98/100
    User Control93/100

    Positive Security Features

    • Communications between the app and Rabobank's servers are strongly secured, making it very difficult for outside parties to intercept banking data while it travels over the network.
    • ThreatFabric fraud detection is integrated into the app, actively monitoring for signs of unauthorized access or device-level threats to protect user accounts.
    • The app's code earned a high Code Safety score, reflecting solid protections against unauthorized modification of the app itself.

    Areas for Improvement

    • The number of analytics and behavioral profiling companies receiving user data is relatively high for a banking app, meaning more organizations can observe how users interact with their finances.
    • Consent controls over which tracking services receive user data could be made more visible and actionable within the app, giving users clearer choice over their privacy.
    • Minor improvements to how certain data is handled on the device would further reduce the amount of information stored locally beyond what is needed.

    About This Analysis

    This scorecard is generated from automated static analysis of the app's code and configuration. It reflects what the app is capable of based on its current build, not necessarily every action taken in every session.

    App Details

    FieldValue
    Packagenl.Rabobank.Bankieren
    Version7.55.1 (build 202603241044)
    Scan Date2026-04-09
    Analysis TypeStatic

    Right of Reply

    Developer not yet contacted