George Romania Security & Privacy Scorecard

Android

93
Overall trust score
Very Secure
92
Security
95
Privacy

Analytics data flows through BCR's own infrastructure rather than directly to third-party companies, limiting external data exposure. Sentry, PostHog, and LUX telemetry are all proxied server-side. Firebase analytics collection is disabled by default.

Best for

Everyday banking with strong privacy defaults

Findings

  • 0 critical
  • 8 high
  • 3 medium
  • 5 low
  • 1 info

9 issues identified across security and privacy analysis.

Top security issues

  • georgeActions JavaScript Bridge Accepts Arbitrary URLs for Authenticated Requests
  • georgeActionHandler JavaScript Bridge Dispatches Internal Activities and Enumerates Actions Without Origin Check
  • BringAppToFrontActivity Custom URI Scheme Accepts Any Caller Without Package Verification

Top privacy issues

  • Sentry OkHttp Interceptor Captures HTTP Response Bodies Including Banking API Responses
  • Dynatrace OneAgent APM Event Database Stores Telemetry Including User Identifier Without Encryption
  • Authorized Caller-ID Anti-Fraud Database Stored Without Encryption

Full analysis

George Romania

What This Means for You

Your banking data is protected by encrypted storage, hardware-backed biometric authentication, and multi-layered fraud detection, giving you a well-secured option for managing your BCR accounts on Android.

Recommendation: Very Secure

Excellent security foundation with encrypted payment databases, biometric authentication, and multi-layered fraud detection. Analytics and crash reporting are routed through BCR's own infrastructure rather than sent directly to outside parties. Recommended for BCR customers seeking reliable mobile banking on Android.

Best For: BCR bank customers seeking a full-featured mobile banking app with strong fraud protection and encrypted payment security

Key Findings

Data Security - 3 findings (2 low, 1 info)

Network Security - 1 finding (1 low)

Code Safety - 4 findings (2 medium, 2 low)

Privacy - 1 finding (1 medium)

Privacy Concerns

What Data is Collected

  • Personal banking details (account numbers, transaction history): sent to BCR servers for core banking operations
  • Device performance metrics and app diagnostics: sent to monitoring services via BCR's own proxy infrastructure
  • Device identifiers: may be used for fraud detection purposes
  • Location: accessed on your device when using location-aware features; may be shared for fraud detection
  • Contacts: accessed on your device to help autofill transfer recipients

Third-Party Data Sharing

The following third parties may receive your data:

  • Dynatrace - Application performance monitoring and diagnostics
  • Google (Firebase Cloud Messaging) - Push notification delivery
  • Google Pay - Payment processing when using Google Pay
  • Google Maps - Map and location display features
  • ThreatMark - Behavioral fraud detection

Understanding the Scores

Security: 92/100
Privacy: 95/100

Security Breakdown

  • Data Security: 95/100 - Payment and authentication data is encrypted with hardware-backed keys. Sensitive databases use strong encryption and banking data backup is disabled to prevent it from being copied via device backups.
  • Network Security: 97/100 - All banking connections are encrypted with no exceptions for any domain. Banking servers are protected with multiple layers of connection security, and app links use verified domain ownership.
  • Code Safety: 86/100 - Strong core security practices throughout, with some internal component access controls that could be further hardened to reduce the risk of manipulation by other apps on the device.

Privacy Breakdown

  • Data Collection: 100/100 - Data collection is minimal and purposeful, focused on what is necessary for banking and fraud prevention. Analytics auto-initialization is disabled by default.
  • Data Sharing: 97/100 - Direct third-party data flows are tightly limited. Analytics, crash reporting, and behavioral monitoring are proxied through BCR's own backend rather than sent directly to outside parties.
  • User Control: 100/100 - Biometric authentication with fingerprint or PIN gives you full control over app access, and hardware-backed keys require your direct authentication before unlocking sensitive operations.

Positive Security Features

  • All network connections require encryption with no exceptions for any domain
  • Payment databases use strong encryption with keys derived from secure storage
  • Authentication and identity data is secured with hardware-backed encryption requiring your biometric or PIN
  • Biometric authentication requires hardware-level user verification before unlocking sensitive operations
  • Multiple layers of fraud detection including behavioral analysis and device integrity checks running in an isolated process
  • Analytics, crash reporting, and monitoring data are routed through BCR's own servers rather than sent directly to third-party vendors
  • Android backup of app data is disabled, preventing sensitive banking data from being copied via device backups
  • Google Pay integration validates the calling app's identity before processing payment intents
  • App links use verified domain ownership to prevent link-hijacking by other installed apps
  • Push notification analytics auto-initialization is disabled in the app manifest

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

  1. Banking Response Capture Scope
    The crash reporting integration may capture portions of banking server responses when errors occur, including data such as account balances or transaction details. Restricting capture to non-sensitive error metadata would further protect financial data in error scenarios.

  2. Screen Content Protection
    Enabling screen content protection for sensitive screens would prevent account balances and transaction details from appearing in the device's recent apps switcher or being captured by screen recording tools.

Security Enhancements

  1. Internal Component Access Controls
    Some in-app browser and transaction signing components accept requests from any source on the device without verifying the requesting app's identity. Adding caller verification to these components would reduce the risk of other installed apps manipulating these flows.

  2. Safe Browsing for In-App Store
    The in-app marketplace browser has Google's Safe Browsing protection disabled. Re-enabling this feature would add a layer of protection against malicious or deceptive content if the store backend were ever compromised.

  3. Development Tools in Production Build
    A translation preview component intended for internal development and QA testing remains included in the production app. While currently low-risk, removing development-only tools from production builds is considered good practice for reducing unnecessary attack surface.

Technical Context

App Type: Mobile banking - financial services, high sensitivity
Classes Analyzed: 53,836
Third-Party Services: 22 identified
Context Tags: financial, sensitive_data, camera, location

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: Banca Comerciala Romana
Version: 26.14.19-google (versionCode 2614192)
Analysis Date: 2026-06-13
Package: ro.bcr.georgego

Analysis Limitations

  • Static analysis only (code review without running the app)
  • Based on APK version 26.14.19-google analyzed on 2026-06-13
  • May not reflect server-side security controls
  • Cannot detect all runtime behaviors

Versions & scan history

ScanDateOverall score
#1 (current) 93/100