# Security & Privacy Scorecard

## VictoriaBank VB24 Mobile

## What This Means for You

Your banking sessions are protected by biometric login and built-in fraud detection, but the app's network settings allow third-party tools to communicate over unencrypted channels, which can expose your activity on public Wi-Fi.

## Recommendation: Use With Caution

The app includes strong protective measures including biometric authentication and active fraud detection that monitors for tampering and suspicious device states. However, the app does not enforce encrypted connections for all outbound traffic, meaning analytics and plugin services could transmit data over unprotected channels on untrusted networks. Routine banking on trusted home or corporate networks is low risk; exercise caution on public Wi-Fi or shared networks.

**Best For:** VictoriaBank customers who need mobile banking access and are comfortable with standard device security practices

## Key Findings

**Data Security** - 4 findings (3 medium, 1 info)

**Network Security** - 5 findings (1 high, 2 medium, 2 info)

**Code Safety** - 5 findings (4 low, 1 info)

**Privacy** - 3 findings (1 medium, 2 info)

## Privacy Concerns

### What Data is Collected

- Account and banking information: account details, session data, payment credentials
- Device information: device integrity signals, security state, installed app presence, VPN and proxy status (collected for fraud detection)
- Location data: used for ATM and branch map display
- Contact information: contacts access declared in app permissions
- Photos: photo library access declared in app permissions
- Payment card information: card details captured via camera scanning

### Third-Party Data Sharing

**The following third parties may receive your data:**

- Firebase (Google) - push notification delivery only; analytics and advertising are disabled
- Wultra AppProtection - device security signals sent to Wultra's fraud detection infrastructure (screen capture, VPN, proxy, and tampering detection)
- Wultra Malwarelytics - device integrity monitoring for banking fraud prevention
- OpenWay (MMA / Apple Wallet) - payment credential generation and Apple Wallet card provisioning
- CardIO - payment card camera scanning (card number recognition)

## Understanding the Scores

**Security:** 78/100
**Privacy:** 87/100

### Security Breakdown

- **Data Security:** 76/100 - Session data is not fully cleared on logout and some secure storage settings use older configurations
- **Network Security:** 70/100 - Encrypted connection enforcement is globally disabled, allowing third-party services to use unencrypted channels
- **Code Safety:** 95/100 - Strong runtime protection and standard security frameworks in use throughout

### Privacy Breakdown

- **Data Collection:** 25/100 - Multiple permission categories are declared, and fraud detection collects broad device signals including app presence and call status
- **Data Sharing:** 100/100 - Third-party data sharing is limited to functional services with no advertising or tracking partners identified
- **User Control:** 91/100 - Biometric authentication and session management give users strong control over account access

## Positive Security Features

- Biometric-protected secure storage using native iOS security frameworks and cryptographically strong key generation
- Comprehensive fraud detection and runtime protection monitoring for tampering, screen capture, proxy interception, and remote access tools
- Firebase analytics fully disabled - Firebase is used only for push notifications with no ad tracking or behavioral profiling
- External links open in Safari with a full address bar rather than in a hidden in-app browser, limiting access to sensitive app functions
- Universal Links correctly configured for deep link routing, providing server-verified link handling

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Completing the Privacy Manifest**
   The app's privacy declaration file is missing despite active use of system storage and push notification services. Adding a complete manifest would ensure App Store privacy labels accurately reflect actual data usage.

2. **Narrowing Location Permission Scope**
   The app requests always-on location access for a feature (ATM map) that only needs location when the app is open. Limiting this to while-in-use permission would prevent unintended background location collection.

3. **Clarifying Permission Explanations**
   The descriptions shown to users when requesting contacts, calendar, and photo access use generic placeholder text. Specific explanations of why each permission is needed would help users make informed decisions.

### Security Enhancements

1. **Clearing Session Data on Logout**
   Signing out should remove all session information from device storage. Currently some session data persists after logout, which could be accessed if the device is later shared or compromised.

2. **Tightening Navigation Permissions**
   The app currently permits navigation to any web address over both encrypted and unencrypted connections. Restricting this to a specific list of trusted domains would reduce exposure to crafted or redirected web content.

3. **Using a Dedicated Deep Link Scheme**
   Registering a unique URL scheme for handling incoming links to the app would prevent other installed apps from sending crafted navigation requests to the banking app.

## Technical Context

**App Type:** Mobile banking application - financial, high sensitivity
**Classes Analyzed:** iOS binary and JavaScript bundle analysis
**Third-Party Services:** 8 identified
**Context Tags:** financial, sensitive_data, location, contacts, camera, biometric

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on iOS applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** VictoriaBank
**Version:** 1.5.5885 (Build 1)
**Analysis Date:** 2026-04-17
**Package:** md.victoriabank.mobilebank

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on IPA version 1.5.5885 analyzed on 2026-04-17
- May not reflect server-side security controls
- Cannot detect all runtime behaviors