# Security & Privacy Scorecard

## George Romania

## What This Means for You

Your banking data is protected by encrypted storage, hardware-backed biometric authentication, and multi-layered fraud detection, giving you a well-secured option for managing your BCR accounts on Android.

## Recommendation: Very Secure

Excellent security foundation with encrypted payment databases, biometric authentication, and multi-layered fraud detection. Analytics and crash reporting are routed through BCR's own infrastructure rather than sent directly to outside parties. Recommended for BCR customers seeking reliable mobile banking on Android.

**Best For:** BCR bank customers seeking a full-featured mobile banking app with strong fraud protection and encrypted payment security

## Key Findings

**Data Security** - 3 findings (2 low, 1 info)

**Network Security** - 1 finding (1 low)

**Code Safety** - 4 findings (2 medium, 2 low)

**Privacy** - 1 finding (1 medium)

## Privacy Concerns

### What Data is Collected

- Personal banking details (account numbers, transaction history): sent to BCR servers for core banking operations
- Device performance metrics and app diagnostics: sent to monitoring services via BCR's own proxy infrastructure
- Device identifiers: may be used for fraud detection purposes
- Location: accessed on your device when using location-aware features; may be shared for fraud detection
- Contacts: accessed on your device to help autofill transfer recipients

### Third-Party Data Sharing

**The following third parties may receive your data:**
- Dynatrace - Application performance monitoring and diagnostics
- Google (Firebase Cloud Messaging) - Push notification delivery
- Google Pay - Payment processing when using Google Pay
- Google Maps - Map and location display features
- ThreatMark - Behavioral fraud detection

## Understanding the Scores

**Security:** 92/100
**Privacy:** 95/100

### Security Breakdown

- **Data Security:** 95/100 - Payment and authentication data is encrypted with hardware-backed keys. Sensitive databases use strong encryption and banking data backup is disabled to prevent it from being copied via device backups.
- **Network Security:** 97/100 - All banking connections are encrypted with no exceptions for any domain. Banking servers are protected with multiple layers of connection security, and app links use verified domain ownership.
- **Code Safety:** 86/100 - Strong core security practices throughout, with some internal component access controls that could be further hardened to reduce the risk of manipulation by other apps on the device.

### Privacy Breakdown

- **Data Collection:** 100/100 - Data collection is minimal and purposeful, focused on what is necessary for banking and fraud prevention. Analytics auto-initialization is disabled by default.
- **Data Sharing:** 97/100 - Direct third-party data flows are tightly limited. Analytics, crash reporting, and behavioral monitoring are proxied through BCR's own backend rather than sent directly to outside parties.
- **User Control:** 100/100 - Biometric authentication with fingerprint or PIN gives you full control over app access, and hardware-backed keys require your direct authentication before unlocking sensitive operations.

## Positive Security Features

- All network connections require encryption with no exceptions for any domain
- Payment databases use strong encryption with keys derived from secure storage
- Authentication and identity data is secured with hardware-backed encryption requiring your biometric or PIN
- Biometric authentication requires hardware-level user verification before unlocking sensitive operations
- Multiple layers of fraud detection including behavioral analysis and device integrity checks running in an isolated process
- Analytics, crash reporting, and monitoring data are routed through BCR's own servers rather than sent directly to third-party vendors
- Android backup of app data is disabled, preventing sensitive banking data from being copied via device backups
- Google Pay integration validates the calling app's identity before processing payment intents
- App links use verified domain ownership to prevent link-hijacking by other installed apps
- Push notification analytics auto-initialization is disabled in the app manifest

## Areas for Improvement

### GDPR / CCPA Compliance

The app's privacy practices could be strengthened by:

1. **Banking Response Capture Scope**
   The crash reporting integration may capture portions of banking server responses when errors occur, including data such as account balances or transaction details. Restricting capture to non-sensitive error metadata would further protect financial data in error scenarios.

2. **Screen Content Protection**
   Enabling screen content protection for sensitive screens would prevent account balances and transaction details from appearing in the device's recent apps switcher or being captured by screen recording tools.

### Security Enhancements

1. **Internal Component Access Controls**
   Some in-app browser and transaction signing components accept requests from any source on the device without verifying the requesting app's identity. Adding caller verification to these components would reduce the risk of other installed apps manipulating these flows.

2. **Safe Browsing for In-App Store**
   The in-app marketplace browser has Google's Safe Browsing protection disabled. Re-enabling this feature would add a layer of protection against malicious or deceptive content if the store backend were ever compromised.

3. **Development Tools in Production Build**
   A translation preview component intended for internal development and QA testing remains included in the production app. While currently low-risk, removing development-only tools from production builds is considered good practice for reducing unnecessary attack surface.

## Technical Context

**App Type:** Mobile banking - financial services, high sensitivity
**Classes Analyzed:** 53,836
**Third-Party Services:** 22 identified
**Context Tags:** financial, sensitive_data, camera, location

---

## About This Analysis

This security analysis was conducted by CITT (Can I Trust That), an independent security analysis service. We perform static code analysis on Android applications to help users make informed decisions about app security and privacy.

### App Details

**Developer:** Banca Comerciala Romana
**Version:** 26.14.19-google (versionCode 2614192)
**Analysis Date:** 2026-06-13
**Package:** ro.bcr.georgego

### Analysis Limitations

- Static analysis only (code review without running the app)
- Based on APK version 26.14.19-google analyzed on 2026-06-13
- May not reflect server-side security controls
- Cannot detect all runtime behaviors