# Security & Privacy Scorecard

## Banca Móvil BAC

**Version:** 5.50.2 (Build 53055002)
**Package:** net.bac.sbe.android
**Scan Date:** 2026-02-09

## What This Means for You

App usage and behavior is shared with Firebase Analytics and AppsFlyer, meaning banking interactions feed marketing and attribution platforms. Revelock and Facephi collect biometric and behavioral data to verify user identity. User activity is also monitored by New Relic and Medallia for performance and feedback purposes.

## Recommendation: Use With Caution

**Best For:** BAC customers comfortable with analytics sharing

## Key Findings

**Data Security** - 7 findings (1 critical, 4 high, 2 medium)

**Network Security** - 1 finding (1 high)

**Code Safety** - 0 findings

**Privacy** - 2 findings (1 critical, 1 high)

## Privacy Concerns

### What Data is Collected

Banca Móvil BAC collects behavioral patterns, biometric data, device identifiers, and app usage activity. Microblink BlinkID processes identity document images during onboarding. Facephi and Revelock/BioCatch collect biometric and behavioral signals continuously to verify user identity.

### Third-Party Data Sharing

User data is shared with multiple third-party platforms:

- **Firebase Analytics** - receives in-app behavior and session data
- **AppsFlyer** - receives attribution and marketing data tied to user activity
- **Revelock/BioCatch** - receives behavioral biometrics for identity verification
- **Facephi** - receives biometric data for authentication
- **New Relic** - receives performance and diagnostic data
- **Medallia** - receives feedback and experience data
- **Microblink BlinkID** - processes identity document images
- **Google ML Kit** - processes on-device data for additional functionality
- **Thales Digital Banking Platform** - provides core banking infrastructure
- **IBM MobileFirst** - provides mobile platform services

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 45/100 |
| Privacy | 35/100 |
| Data Security | 50/100 |
| Network Security | 75/100 |
| Code Safety | 55/100 |
| Data Collection | 30/100 |
| Data Sharing | 70/100 |
| User Control | 40/100 |

## Positive Security Features

- Biometric identity verification through Facephi and Revelock/BioCatch adds a meaningful layer of protection for account access
- Network communications scored relatively well, indicating basic transport protections are in place
- Document identity verification via Microblink BlinkID supports more secure account onboarding

## Areas for Improvement

- Banking activity is collected by multiple analytics and marketing platforms, with limited transparency about how long that data is retained or how it is used beyond its stated purpose.
- Biometric and behavioral data collection by third parties warrants clearer disclosure and stronger controls over what data is shared and when.
- The low User Control score (40/100) reflects limited options for managing or limiting what information is passed to third-party services.

---

## About This Analysis

This scorecard is based on automated static analysis of version 5.50.2 of the published app.

### App Details

- **App Name:** Banca Móvil BAC
- **Package ID:** net.bac.sbe.android
- **Version:** 5.50.2 (Build 53055002)
- **Scan Date:** 2026-02-09
- **Platform:** Android