mBank SK Security & Privacy Scorecard

mBank SK

What This Means for You

Your login details, account data, and financial transactions are protected by strong, layered security, and behavioral tracking is disabled. A marketing service receives information about your banking product tier.

Recommendation: Trustworthy

mBank SK delivers strong banking security: all connections to mBank's servers are verified and tamper-resistant, your device's integrity is actively monitored, and your login details are secured by hardware. Analytics tracking is disabled. This is a reliable choice for everyday mobile banking.

Best For: People who want a full-featured mobile banking app with strong built-in security protections

Key Findings

Data Security - 1 finding (1 medium)

Network Security - 2 findings (1 low, 1 info)

Code Safety - 2 findings (2 medium)

Privacy - 3 findings (1 medium, 1 low, 1 info)

Privacy Concerns

What Data is Collected

• Account and transaction data: accessed on your device to display balances, history, and manage your banking
• Location: accessed on your device to show nearby ATMs and branches
• Contact information: accessed on your device to help you send payments by phone number
• Call log history: accessed and sent to mBank's security systems during the authentication setup process to detect suspicious calls
• Device information: sent to mBank's performance monitoring and fraud detection systems

Third-Party Data Sharing

The following third parties may receive your data:

• Synerise - receives behavioral events and your banking product tier classification for marketing purposes
• Firebase (Google) - receives performance diagnostics and delivers push notifications; behavioral analytics are disabled
• Google Maps (Google) - receives your location to display ATM and branch locations

Understanding the Scores

Security: 88/100
Privacy: 90/100

Security Breakdown

• Data Security: 88/100 - Your account details and financial information are strongly protected by hardware-backed secure storage. A secondary encryption layer for less critical app preferences uses a predictable setup on first install, noted as an area for improvement.
• Network Security: 96/100 - All communications with mBank's servers are secured with enforced, tamper-resistant connections. Unencrypted connections are blocked globally across every server endpoint.
• Code Safety: 89/100 - The app includes multi-layer device integrity and tampering detection, screenshot blocking to prevent screen capture by other apps, and no embedded private keys or service secrets in the app package.

Privacy Breakdown

• Data Collection: 93/100 - The app collects only what is needed for banking features and security verification. Behavioral analytics are explicitly turned off across the app.
• Data Sharing: 93/100 - Data flows to external services are tightly controlled, with sharing limited to performance diagnostics and a marketing partner that receives your banking product tier.
• User Control: 93/100 - You can request that your data be deleted, and if your device is lost or stolen you can remotely disconnect the app through online banking.

Positive Security Features

• Enforced, tamper-resistant connections across all mBank servers, with unencrypted connections prohibited globally
• Failed or untrusted connections are immediately blocked, including in in-app browser views
• Multi-layer device integrity and tampering detection with native hardware-assisted checks
• Screenshots blocked to prevent screen capture by other apps on your device
• Behavioral analytics tracking explicitly disabled across the app
• Your PIN and biometric login details are protected by your device's hardware security chip
• The app cannot be backed up via computer, preventing data extraction from a connected PC
• Production build is correctly sealed: debug mode off, all logging disabled, no embedded private keys or service secrets

Areas for Improvement

GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. Call Log Disclosure
   The authentication setup process accesses historical call records, not just whether a call is currently active. Users should receive clear notice of this access, as historical call metadata constitutes sensitive personal data under GDPR.

2. Marketing Data Minimization
   Information about your banking product tier is sent to a marketing service. Adding an explicit opt-out or restricting the data to less specific categories would better align with data minimization principles.

Security Enhancements

1. Preference Encryption Initialization
   A fallback encryption setup for app preferences relies on a predictable value on first install before the user logs out. Generating a unique device key immediately at first launch would close this gap.

2. Legacy In-App Browser Component
   An older in-app browser component retains an HTTP bridge to banking services that could be further restricted or removed to reduce exposure in legacy banking features.

Technical Context

App Type: Mobile banking with biometric authentication and financial transaction management
Classes Analyzed: 35,250
Third-Party Services: 21
Context Tags: financial, sensitive_data, location, camera, biometric

---

About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

App Details

Developer: mBank S.A.
Version: 3.119.0 (versionCode 94785)
Analysis Date: 2026-06-13
Package: sk.mbank

Analysis Limitations

• Static analysis only (code review without running the app)
• Based on APK version 3.119.0 analyzed on 2026-06-13
• May not reflect server-side security controls
• Cannot detect all runtime behaviors