Illustration. Generic screens, no real bank.
- ›
device onlinethe fake app checks in with its server
2nd edition
The state of
Mobile Banking App Security 2025
We scanned more than 500 of the top banking apps on Android and iOS. Here is what we found.
Findings
Most banking apps still hand out the keys to their backend
Most common finding
of banking apps contain hardcoded secrets
API keys, tokens and credentials sit in the code or resource files. Anyone who downloads the app can pull them out.
Source: Ostorlab analysis of 500+ top banking apps, 2025
We tested more than 500 of the top banking apps worldwide, on Android and iOS, with static, dynamic and behavioural analysis.
Nearly 1 in 2 apps ship a library with a known critical flaw
over 46% of the apps tested
Nearly 3 in 10 apps let attackers bypass biometric login
over 28% of the apps tested
FIG 1.1
Share of banking apps affected, by vulnerability
Root detection was found in more than 40% of apps. Weak cryptography (ECB mode, MD5, static IVs) appeared in a small number of apps.
Source: Ostorlab analysis of 500+ top banking apps, 2025
Critical
Up to 19
critical vulnerabilities found in a single banking app
Most apps have 0 to 2. A small group has 10 or more. In a banking app, even one is serious.
These vulnerabilities are not theoretical. They are real risks affecting millions of users across both platforms.
App age
Banking apps are older than they look
Almost every app shipped an update in the last six months. Many were first published more than ten years ago, on code that was not written for today's attacks.
47.7%
of iOS banking apps first shipped before 2014
Old codebases need constant work to stay safe. Frequent releases do not prove that work is done.
FIG 2.1
Banking apps by first release date
- 2008–11
- 2011–14
- 2014–16
- 2016–19
- 2019–22
- 2022–25
Source: Ostorlab analysis of 500+ top banking apps, 2025
94.7%
of iOS apps released a version in the last six months
88.8%
of Android apps did the same
Frequent updates do not mean secure updates. Many releases add features or change the interface, and only 1% of apps had a latest version older than a year.
Backends
Nearly every bank's app talks to servers in the United States
Most of these banks are not American. A breach or outage at a large US provider could hit many banks at once, and customer data falls under US rules.
FIG 3.1
Where banking app backends are hosted, by rank
>77% of backends
Top 10 by number of backends
- 1United States
- 2Canada
- 3South Korea
- 4Ireland
- 5Germany
- 6France
- 7Singapore
- 8Netherlands
- 9Australia
- 10Hong Kong SAR China
The report ranks 49 countries by number of backends. It gives a share only for the United States.
Source: Ostorlab analysis of 500+ top banking apps, 2025
iOS apps rely on very few servers: 78% talk to 2 or fewer. Android apps talk to many more, and each one is something to secure.
Tech stack
The same building blocks, in hundreds of banking apps
The scans fingerprinted the languages, native code and libraries inside each app. A flaw in one popular library becomes a flaw in hundreds of banks.
zlib
Data compression
~55%
Out of 10 banking apps
OpenSSL
Network encryption
>51%
Out of 10 banking apps
SQLite
Local data storage
>35%
Out of 10 banking apps
Firebase
Backend services
34%
Out of 10 banking apps
Not hypothetical: the scans found zlib 1.2.8, a version with known vulnerabilities, in banking apps.
Also insideC/C++ >72%Kotlin (Android) >61%Objective-C (iOS) >65%
FeaturesBiometric login >65%Analytics >45%User tracking 1%
Permissions
Some apps ask for access no bank needs
Every permission is a way in. Most requests match what a banking app does. Some are hard to explain.
Expected
What a banking app plausibly needs. Where the report gives a share, the bar shows it.
- Camera ~95%
- Face ID 80%
- Fingerprint and biometrics ~80%
- Network access Nearly all
- Notifications Common
- Precise location Widely used
Hard to justify
A small share of apps request access with no clear banking use. Banking apps should ask for the minimum they need.
Record audio from a background service
FOREGROUND_SERVICE_MICROPHONEDoes a banking app need this?
Nearly 40% of Android banking apps also run 11 to 20 background services, and 16% run 21 to 30. More services mean more entry points to protect.
Case study
ToxicPanda shows how a banking trojan empties an account
ToxicPanda is an Android banking trojan identified by Cleafy in late 2024. It takes over accounts and moves money from the victim's own phone, which gets past many fraud checks.
How the attack works
65%
of infected devices were in Italy
Followed by Portugal with 21.4%. It was first seen targeting users in Europe and Latin America.
FIG 6.1
Where the infected devices were
- Italy
- Portugal
- Others
Source: Cleafy, 2024
It survives reboots, asks again if Accessibility is turned off, and falls back to generated domains if its servers are taken down. Sources: Cleafy, Bitsight.
Outlook
What changes next
New technology brings convenience, and attackers use the same technology to move just as fast.
Biometrics and blockchain
- Promise
- Fingerprints, face scans and blockchain can raise security.
- New risk
- Stolen biometric data cannot be changed, and blockchain can be weak where it is built or integrated.
Banking inside other apps
- Promise
- Banking inside shopping, ride-hailing and social apps brings convenience and new services.
- New risk
- It widens the attack surface and privacy risks, and needs strict checks on every third party.
Digital-only banks
- Promise
- Digital-only banks are reshaping banking and challenging old rules.
- New risk
- Compliance gaps, and a breach or outage hits trust harder with no branch to fall back on.
AI on both sides
- Promise
- AI improves banking services and fraud detection.
- New risk
- Biased or opaque models, attacks on the AI itself, and deepfakes that pass as customers or bank staff.
The response
Security in every build
Automated scans at every step of development, secure coding standards such as the OWASP Mobile Top 10, and AI tools that find bugs early.
How we tested
- 500+ banking appsTop apps worldwide, on Android and iOS.
- 01Static analysisOstorlab's engine read each app's code and files for secrets, vulnerable dependencies, injection and weak crypto.
- 02Dynamic analysisMonkey Tester ran and drove each app in a controlled environment, with API hooking.
- 03Backend testingIntercepted traffic was checked for known vulnerabilities and fuzzed for SQL injection and XXE.
- FindingsThe issues counted across all apps in this report.
Not covered: issues behind a login. The dynamic scans ran without signing in to the apps.
Security can no longer be an afterthought or a compliance checkbox. It must be built into the design, development and release of every banking app.
Every edition
- 2025Mobile Banking App Security Research 2025500+ top banking apps worldwide, Android and iOS.You are reading it
- 2024Security Landscape of Mobile Banking Applications in North AmericaThe first edition: banking apps in the United States and Canada.Read the report
Download the full report
40 pages of findings, charts and the ToxicPanda case study.