FNB Banking App Security & Privacy Scorecard
Android
In-app behavior is tracked through Google Analytics and Tag Manager, meaning how users navigate and use the app is collected. Data is shared with very few outside companies, which is a genuine strength. Some aspects of how financial information is handled locally fall below the standard expected for a banking app.
Best for
FNB customers managing accounts on mobile
Findings
- 0 critical
- 3 high
- 9 medium
- 6 low
- 6 info
1 issue identified across security and privacy analysis.
Top security issues
- Visa SDK performs global SSL trust-all bypass and process-wide hostname verifier override during payment key provisioning, enabling MitM of contactless payment token injection
- Server-controlled WebView file access settings allow a compromised or intercepted server response to enable arbitrary file:// URI access from JavaScript in banking WebViews
- Server-driven arbitrary Intent launch via activity:// scheme allows a compromised server or MitM attacker to trigger phone calls, package installation, or deep links in other apps
Top privacy issues
- Firebase Analytics and Google Advertising ID collected from app launch before any consent gate, creating POPIA regulatory exposure for a South African banking app
- Device sensor fingerprinting transmits step count, activity classification, barometric pressure, and ambient light to FNB backend — well beyond fraud detection necessity, constituting a continuous behavioral profile
- Accessibility service enumeration reports full service names and descriptions to FNB server, capable of revealing disability status (TalkBack = visual impairment) — a special personal information category under POPIA
Full analysis
Security Score: 76/100 | Privacy Score: 72/100
What This Means for You
In-app behavior is tracked through Google Analytics and Tag Manager, meaning how users navigate and use the app is collected. Data is shared with very few outside companies, which is a genuine strength. Some aspects of how financial information is handled locally fall below the standard expected for a banking app.
Recommendation: Use With Caution
Best For: FNB customers managing accounts on mobile
Key Findings
Data Security - 6 findings (4 medium, 1 low, 1 info)
Network Security - 4 findings (1 high, 2 low, 1 info)
Code Safety - 0 findings
Privacy - 6 findings (1 high, 2 medium, 2 low, 1 info)
Privacy Concerns
What Data is Collected
The app collects behavioral data about how users navigate and interact with it, including usage patterns and session information, through Firebase Analytics, Google Tag Manager, and Firebase Performance Monitoring. Device and error information is gathered for crash reporting via Firebase Crashlytics. The app also processes account details, transaction history, and financial information to deliver its core features.
Third-Party Data Sharing
Usage and behavioral data is shared with Google through several Firebase services covering analytics, crash reporting, push messaging, and performance monitoring, as well as Google Tag Manager. Payment-related data is shared with Visa for access control purposes. On Huawei devices, push notification data is shared with Huawei HMS. The app's high Data Sharing score of 92/100 reflects that only a small number of outside companies receive user data.
Understanding the Scores
| Category | Score |
|---|---|
| Security | 76/100 |
| Privacy | 72/100 |
| Data Security | 50/100 |
| Network Security | 72/100 |
| Code Safety | 74/100 |
| Data Collection | 68/100 |
| Data Sharing | 92/100 |
| User Control | 72/100 |
Positive Security Features
- No standout positive security practices were identified in this version of the app.
Areas for Improvement
- Some local data protection practices should be strengthened to better safeguard financial information stored on device.
- Certain server connections the app makes could do more to protect data while it travels between the device and FNB's systems.
- In-app behavior is tracked by several analytics tools simultaneously. Reducing or consolidating this tracking would better respect user privacy.
About This Analysis
This scorecard is based on automated static analysis of the app's code and behavior. Scores reflect practices observed in the analyzed version and may change with updates.
App Details
| Field | Value |
|---|---|
| Package ID | za.co.fnb.connect.itt |
| Version | 7.17.1-60 (build 6183) |
| Developer | Not specified |
| Platform | Android |
| Scan Date | 2026-04-07 |
Versions & scan history
| Scan | Date | Overall score |
|---|---|---|
| #1 (current) | 73/100 |