Scan results

Recommendation: Use With Caution - Debug Tools in Production

Banking app with strong fundamentals: verified server connections, hardware-protected login credentials, and a strong authentication system meeting European banking standards. However, the production build ships a network traffic capture tool and a server-redirect panel with the ability to suppress identity verification steps. Financial events route to Google and Salesforce. These testing tools must be removed before this build can be fully trusted.

Key Findings

Data Security - 3 findings (1 medium, 1 low, 1 info)

Network Security - 3 findings (2 medium, 1 info)

Code Safety - 6 findings (1 high, 3 medium, 1 low, 1 info)

Privacy - 5 findings (4 low, 1 info)

Privacy Concerns

What Data is Collected

• Personal information: name, email, phone (for account and KYC flows)
• Financial activity: completed payments, transfers, loan applications, screen navigation within the app
• Device information: device identifiers, IP address, operating system
• Location data: precise location (requested for ATM finder; may also be used for fraud detection)
• Usage data: screen views, feature interactions, push notification engagement

Third-Party Data Sharing

The following third parties may receive your data:

• Google (Firebase Analytics, Firebase Crashlytics) - analytics, event tracking, crash reporting
• Salesforce Marketing Cloud - marketing communications and push notifications
• Adjust - attribution tracking for advertising campaigns (with consent)
• Countly (self-hosted by Raiffeisen Romania) - behavioral analytics and navigation tracking
• Infobip - in-app live chat support
• Revelock - fraud detection (device fingerprint and location)
• Medallia / Evergage - customer experience and personalization
• Onfido - identity document verification (KYC)
• Pago - payment and insurance sub-flows

Understanding the Scores

Security: 77/100
Privacy: 83/100

Security Breakdown

• Data Security: 84/100 - Login credentials are stored in hardware-protected secure storage; some file categories use a weaker protection level that allows access after the first device unlock
• Network Security: 85/100 - Server connection verification is strong overall; exceptions for insecure connections to a production financial widget server and test domains reduce this score
• Code Safety: 78/100 - Strong authentication architecture, but a debug network capture tool and a server-redirect panel with identity verification bypass are compiled into the production binary

Privacy Breakdown

• Data Collection: 90/100 - Collection scope is appropriate for a banking app; location permission is broader than the stated ATM-finder purpose
• Data Sharing: 89/100 - Financial transaction events and navigation data are shared with Google and Salesforce; data minimization for these events cannot be fully confirmed
• User Control: 92/100 - Advertising tracking requires your explicit consent, and push notification registration is deferred until you agree

Positive Security Features

• Server connection verification uses a strict, fail-closed approach - connections are blocked outright if the server does not present the expected certificates
• Login credentials and session data are stored in the device's secure hardware storage with device-only binding, not accessible via cloud backup
• Biometric authentication keys are protected by the device's dedicated security chip (Secure Enclave) with access controls requiring your biometric
• The strong authentication framework used meets European PSD2 requirements for Strong Customer Authentication
• Advertising tracking is gated behind your explicit consent with runtime enforcement confirmed
• Secure connection requirements are correctly enabled globally; insecure connections are opt-in exceptions only
• Push notification registration is deferred until you provide consent

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Clarify Financial Event Data Minimization
   Completed payment and KYC flow events are routed to Google Analytics and Salesforce. Documenting exactly which fields are included in these events and confirming they contain no amounts or beneficiary details would close the current data minimization gap under GDPR Article 5(1)(c).

2. Align Location Permission Scope With Actual Use
   The app requests background location access but justifies it only as an ATM finder. If location is also used for fraud detection, this purpose should be separately disclosed to users.

3. Disclose Third-Party IP Address Lookup
   Your public IP address is sent to an independent third-party service (api.ipify.org) not affiliated with Raiffeisen Romania. This disclosure should appear in the app's privacy documentation and data processing records.

Security Enhancements

1. Remove Debug and Testing Tools From Production Builds
   The production binary contains a network traffic capture tool and a full server-redirect panel (including the ability to switch to test or pre-production backends and suppress identity verification). These should be excluded from production builds using conditional compilation.

2. Remove Test Environment Addresses and Certificates
   Pre-production server addresses and test certificates are embedded in the production binary. Removing these reduces the exposed internal infrastructure footprint.

3. Restrict Insecure Connections for Production Servers
   The app allows unencrypted connections to the production financial widget server and several test domains. The production widget server exception should be replaced with a secure connection.

4. Validate Incoming Deep Link Sources
   The custom URL scheme used for banking actions (payments, PSD2 consent flows) accepts calls from any installed app on the device without verifying the caller's identity. Adding caller verification or restricting handling to known sources would reduce exposure.

Technical Context

App Type: Mobile banking - high sensitivity financial application
Classes Analyzed: 24
Third-Party Services: 21 identified
Context Tags: financial, sensitive_data, location, camera, biometric, psd2, banking, kyc, analytics

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

App Details

Developer: Raiffeisen Romania
Version: 68.3.0 (Build 2)
Analysis Date: 2026-04-17
Package: ro.raiffeisen.new.smartmobile

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on IPA version 68.3.0 (Build 2) analyzed on 2026-04-17
• May not reflect server-side security controls
• Cannot detect all runtime behaviors