# Security & Privacy Scorecard

## BBVA Perú | Banca Móvil

## What This Means for You

App usage and behavior is analyzed by BioCatch for fraud detection and shared with AppsFlyer and Firebase for analytics and marketing. Salesforce Marketing Cloud receives user data to power targeted communications. User data travels with less protection than expected when connecting to the bank.

## Recommendation: Use With Caution

**Best For:** BBVA Peru customers who need mobile banking access

## Key Findings

**Data Security** - 3 findings (1 high, 1 medium, 1 low)

**Network Security** - 2 findings (1 critical, 1 high)

**Code Safety** - 0 findings

**Privacy** - 3 findings (2 medium, 1 low)

## Privacy Concerns

### What Data is Collected

- Behavioral and biometric patterns collected by BioCatch for fraud detection
- App usage and session data shared with AppsFlyer and Firebase for analytics
- Location data accessed through Google Maps and Google Places
- Payment transaction data processed through Redsys and Samsung Pay
- Identity verification data handled by Veridas

### Third-Party Data Sharing

- **BioCatch** - behavioral fraud detection
- **AppsFlyer** - marketing analytics and attribution
- **Firebase** - app analytics and performance monitoring
- **Salesforce Marketing Cloud** - targeted marketing communications
- **Google Maps / Google Places** - location services
- **Redsys** - payment processing
- **Samsung Pay** - mobile payments
- **Veridas** - identity verification
- **Akamai Bot Manager** - bot detection and protection
- **FIDO UAF (Nok Nok Labs)** - authentication framework

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 45/100 |
| Privacy | 55/100 |
| Data Security | 40/100 |
| Network Security | 35/100 |
| Code Safety | 50/100 |
| Data Collection | 60/100 |
| Data Sharing | 65/100 |
| User Control | 70/100 |

## Positive Security Features

- No notable positive security practices were identified for this version of the app.

## Areas for Improvement

- Network security protections should be strengthened so that the connection to bank servers is better secured during banking sessions.
- Behavioral and usage data is shared with multiple analytics and marketing platforms. Making this data sharing optional would give users more control over how their information is used.
- Data handling practices within the app should be improved to better protect personal and financial information.

---

## About This Analysis

Scores reflect the security and privacy practices found in the version of the app listed below. The analysis covers code structure, data handling, and third-party integrations.

### App Details

| Field | Value |
|---|---|
| App | BBVA Perú \| Banca Móvil |
| Package | com.bbva.nxt_peru |
| Version | 25.120.7 |
| Scan Date | 2026-02-14 |