Can I trust George Romania?
This scan is more than 90 days old.
This app has an open trust check or a verdict held for review.
- Best for
- Everyday banking with strong privacy defaults
- What it means for you
- The build includes code to send analytics data to BCR's own infrastructure rather than directly to third-party companies, limiting external data exposure. Sentry, PostHog, and LUX telemetry are all proxied server-side. Firebase analytics collection is disabled by default.
- Main concern
- Sentry SDK captures up to 150KB of banking API response bodies including financial data
- The developer's description
- Smart mobile banking from Romania's BCR. Send transfers, pay bills, scan IBANs with your camera, track accounts, and manage finances with fingerprint or pattern lock. Available on phones and tablets.
- Third-party services
- 22
- Findings rated low or higher
- 8
Open on Google PlayOpens the app's listing on Google Play in a new tab.
Full findings
Open this scan in your dashboardThe account that ran this scan sees every finding and the Rescan button there.
Trust checks
Secure by Design
StrongStrong security foundation
Why this result
This check looks for security issues at high severity or above in the code of this build, and none were recorded. Its scope covers stored credentials, how the app protects data on the device, and how it protects data in transit.
The app has no critical or high-severity security vulnerabilities. All internet traffic is encrypted with no exceptions for unencrypted connections, and the bank's servers are pinned so forged certificates cannot intercept data in transit. Sensitive databases use strong encryption with keys protected by the device's secure hardware. Authentication credentials require biometric or PIN confirmation before use, and device backups are blocked. Three medium-severity issues were found: an error reporting service captures banking server response data before forwarding it through the bank's own relay; and two internal screens displaying bank web content allow those pages to trigger file downloads or navigate the app without validating the source URL — both requiring an attacker to first compromise a bank-controlled web page. These are meaningful hardening items but no direct exploitation path exists without first breaching the bank's web infrastructure.
Data Minimization
StrongTracking done right
Why this result
The check looks at analytics and attribution code for companies other than the developer: the data it reads, the companies named in code as recipients, and whether a consent step runs before that code. In this build, either no such code was recorded, or a consent step runs before it and the app's own disclosures describe the collection.
Built-in Google analytics is explicitly disabled in the app configuration. The two analytics tools that are active — a product usage tracker and an internal bank analytics service — both route through the bank's own servers, so usage data does not go directly to outside companies. Crash reporting is configured in the code to use a bank-controlled relay rather than the crash reporting provider directly. No evidence was found of any data collection or analytics firing before the user interacts with the app.
Manifest Mismatch
StrongEverything visible
Why this result
The check compares the app's privacy disclosures against what the code does: the data categories collected, the companies named in code as their recipients, and the identifiers attached to each. The comparison covers the store listing, the in-app privacy text and any privacy manifest shipped in the build. Every claim compared matched the code here.
No confirmed mismatch between the app's actual behavior and its privacy disclosures was identified. The crash reporting service captures banking server response data, and the build includes code to relay it through the bank. The fraud detection service includes code to read extensive device information. These are the areas most worth verifying against the bank's published privacy policy. No finding in the analysis specifically identified an undisclosed data practice or a stated policy that the code contradicts.
User Control
StrongNo lock-in
Why this result
The check looks for a way to export the data an account has accumulated and a way to delete the account itself. In this build, either both were found, or the app has no account of its own and keeps its data on the device. For an app without an account, the developer has no server-side copy to export or delete, and deleting the app removes the data in its own storage.
No proprietary data formats or artificial barriers to switching banks were found. Account data is held server-side by the bank under standard regulatory obligations for data portability and account closure. No code pattern was identified that would trap user data or create unreasonable obstacles to leaving the service.
Truly Local
Items recorded, result pending reviewContains code to send personal data off the device
Why this result
This app presents itself as working offline or on the device alone, and this build contains code written to send personal data to servers. The check covers analytics, crash reporting, advertising code and any first-party endpoint the code addresses personal data to. Code of this kind is common; what this check reports is the distance between that code and how the app describes itself.
Strengths
- Cleartext traffic globally blocked via network security config with no HTTP exemptions
- Certificate pinning at both OS (NSC) and application (OkHttp interceptor) layers for all banking domains
- allowBackup=false prevents Android backup exposure of sensitive data
- SQLCipher encrypted databases for Pago payment data with derived keys
- AndroidKeyStore-backed AES/GCM encryption for auth and KYC data with user authentication required
- Biometric key binding with userAuthenticationRequired=true
- Multi-layered anti-fraud: ThreatMark behavioral detection (isolated process), RootBeer native root detection, Innovatrics REQUIRE_SECURE_ENV=1
- Firebase analytics auto-init disabled in manifest
- Sentry, PostHog, and LUX analytics all proxied through BCR's own backend infrastructure
- App Links use autoVerify=true preventing intent hijacking
What the app contains
22 services
Third-party services the scan names in the build:
- Dynatrace OneAgent
- Sentry
- Crowdin
- ThreatMark
- RootBeer
- Innovatrics DOT
- HID Global
- Erste Locker
- NimbusDS JOSE
- Pago SDK
- Google Pay
- Microblink PhotoPay
- Google ML Kit
- SQLCipher
- Bouncy Castle
- Azure Communication Services
- GetStream
- Firebase Cloud Messaging
- Google Maps
- PostHog
- LUX (Erste Group)
- JMRTD
Libraries
| Library | Version | Advisory |
|---|---|---|
| ExoPlayer / media3 | not recorded | none confirmed |
| Room | not recorded | none confirmed |
| Lottie | not recorded | none confirmed |
| Dynatrace | not recorded | none confirmed |
| Facebook SDK | not recorded | none confirmed |
| Jackson | not recorded | none confirmed |
| Glide | not recorded | none confirmed |
| Datatransport | not recorded | none confirmed |
| Google Sign-In | 12451000 | none confirmed |
| Google Play Services | 12451000 | none confirmed |
Show all 25 librariesShow fewer
Method and limits
Static analysis: the decompiled code, manifest and resources of this build, read file by file. Network traffic at run time is established by a capture of the running app.
- Files decompiled
- 53,836
- Scan date
- 13 June 2026
Corrections
No correction is published for this app.
Developer response
No response is published for this app.
Report an error Opens an email to [email protected] that names this app and this scan.