2026 edition
Apps from independent neobanks are rated high-risk more often than traditional banks' apps: 79% against 51%.
Mobile banking app security
We looked at 2,690 banking apps on Android, iOS and HarmonyOS, from 500 banks. Two sources: the apps themselves, read and scanned by Ostorlab, and public information such as store pages, the banks' websites and threat reports.
Key findings
Over 3.7 billion Google Play downloads across the Android apps we checked.
Ratings don't show security: 3.8 stars with a critical flaw, 3.9 without.
Protecting the customer
What banking apps carry to protect customers: checks around payments and scams, how the account is tied to the phone, and how far each app goes step by step.
One row per protection in the app's code. Filled dots are apps that have it.
FIG 1.1
Only 19% of banking apps carry fraud-detection code, 17% a scam warning
Android, iOS and HarmonyOS apps, read from their code. Screen-overlay checks apply on Android and HarmonyOS only, so that row is a share of those apps.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
A stolen password shouldn't work on another phone. Filled dots are apps that check for it.
FIG 1.2
90% of apps tie the account to one phone, but only 51% keep its key in a secure chip
Android, iOS and HarmonyOS apps, read from their code. Signed requests, screen-lock checks and key attestation exist on Android and HarmonyOS only, so those rows are shares of those apps.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
72% of iOS apps unlock with a simple yes/no fingerprint or face check, which a tampered app can fake.
Each step counts only the apps that also have every step before it, so the share drops as you go. Each phone is 5% of apps.
FIG 1.3
Only 11% of banking apps have every step against a scam call
A fraudster calls and talks the customer through a payment while watching the screen. Can the app tell a call is on, see the screen being shared, and warn?
100% of apps still have every step
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
Tamper resistance
Copied apps, unlocked phones, fake phones, tampering tools: we read each Android app's code for the checks an attacker runs into. First, make a guess.
FIG 2.1
Apps with each anti-tampering check, out of 100
Out of 100 banking apps, how many have all nine of these checks?
Android apps. A check counts only when the bank's own code uses it, not when it just sits inside an outside library.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
99% of these apps still install on Android versions that no longer get security fixes. So do 99% of the apps that check for unlocked phones: they turn away a tampered phone but let in an outdated one.
Modern defenses
With a stolen password, there are four ways into an account. These four defenses close them. Here is how often each one is in the apps' code.
FIG 3.1
Passkeys block two kinds of attack, yet only 5% of apps offer them
Found in the app's code. Android: passkeys, Google's app check (Play Integrity) and fingerprint-locked keys. iOS: passkeys and Apple's app checks. 4% still use SafetyNet, the app check Google has shut down.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
Before attackers tamper with an app, they read its code. Scrambled code and hardened native code slow them down. Apps built for an old Android version miss protections newer versions turn on by default.
FIG 3.2
30% of apps scramble most of their code
Android apps whose code we could read. Hidden code: counted only for apps written in Java or Kotlin. Native code: apps with their own low-level code. Up to date: Android 16 or newer.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
A passkey needs two halves: code in the app, and a file on the bank’s website that names the app. Without that file, the phone will not offer passkeys for the bank. We checked both halves in every Android and iOS app. First the phone shows how a passkey works, then it tries to sign in on every app built for passkeys.
FIG 3.3
Only 10% of Android apps built for passkeys can actually use them
Step 1 of 3
A passkey replaces the password
You sign in with your fingerprint or face. There is nothing to type, so nothing to steal or phish.
Website ready: the bank's website lists the app for passkey sign-in. Apps with neither half aren't shown. On iOS we count only passkey code we could confirm. HarmonyOS apps are left out: they don't support passkeys.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
Shared platforms
A few ready-made app platforms and code libraries sit inside many banking apps. One flaw in one of them hits many banks at once.
FIG 4.1
One flaw in the biggest shared app platform would hit 4 of 100 banks
14of 100 banks build their app on a shared platform
Also shared inside the apps, whoever builds them
Outside code libraries
App protection products
385 banks checked · Android apps whose code we could read. A bank counts on a platform when one of its apps is built on it; a bank on two platforms counts once. One more bank uses TCS BaNCS (under 1%). Libraries and protection products: share of apps. Huawei Mobile Services ranks high because many Google Play apps also carry it, to run on Huawei phones.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
A protection product does not make an app clean: apps with one more often have a secret key in the code (29% against 19%) and an old library with a known flaw (53% against 40%).
Ready-made apps
Some banks buy a ready-made (white-label) app from a vendor. We compared every pair of apps from the same vendor, on their weaknesses and their protections, and did the same for unrelated apps. They clearly share protections; weaknesses are mixed, and some vendors' apps share fewer than unrelated apps. Each sheet is one bank’s app, and its circle holds the app’s weaknesses or protections. The overlap is what both apps share. The dashed ring shows the overlap for two unrelated apps.
FIG 4.2
Two Temenos apps share 67% of their protections; two unrelated apps share 25%
In common: of all the weaknesses (or protections) two apps have, the share they both have, typical over every pair of a vendor's apps. Unrelated apps: 20,000 random pairs. Q2 and NCR D3 are small groups. We find vendors from the code, so apps without their marks are missed.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
What the apps do
Money transfers to people, card controls, virtual cards, budgets: we counted the features each app has in its code and describes on its store page. Each one is something an attacker can reach.
FIG 5.1
3 of 4 banking features are more common in neobank apps than in traditional banks’
Counted only when the app's code has the feature and its store page mentions it. Android and iOS apps. Neobanks: 29 apps, a small group; traditional banks: 848 apps.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
Before any feature, there is the download: what it asks for, how big it is, how often it changes, and how old a phone it still runs on.
FIG 5.2
The typical Android banking app asks for 23 permissions and weighs 68 MB
Android apps. "Typical" is the middle value (median). Old phone system: the app still installs on Android 13 or older, which no longer gets security fixes.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
Updating often does not mean fewer flaws: 63% of Android apps updated every three weeks or less have a critical or high flaw, against 51% of those updated less than every three months. Update dates come from versions named in store reviews.
AI assistants
Banks are adding AI assistants to their apps. Each one is a new place to leave a key behind.
3.7%
of banking apps ship an AI assistant
30% of those have a secret key written into the app, where anyone can pull it out.
FIG 6.1
30% of apps with an AI assistant leave a secret key in their code, against 19.9% without one
Think of the app as a front door: a key left in the code is a key left on the step. Watch what happens when the bank adds an AI assistant.
Apps without an assistant leave secrets too, only less often: one in five.
Assistant: a chatbot built into the app; live chat with a person doesn't count. Secret key: one our scan is sure about, not counting Google's API keys, which apps ship by design. No app had a key for an AI service. 2 apps call Gemini, Google's AI, and neither has an assistant. Bigger banks tend to have both an assistant and more add-ons, so this is a link, not a cause.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
Updates and privacy
Apps are built from ready-made code libraries, and most have newer versions out. For each library we counted how many versions behind the latest it is. Drag along the scale.
3
releases behind the latest, for the typical app’s libraries
FIG 7.1
98% of Android banking apps have at least one library 10 versions out of date
99%of apps have libraries that are typically 1 release or more behind the latest.
Android apps. Each library is compared with its newest stable version.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
Not only libraries: about 1 in 20 banks has had a public security flaw (CVE) in its own app, most of them years ago.
of Android banking apps leave something off their store privacy label that the app asks for or has partner code to collect
Share of apps whose label leaves this out, though the app asks for it or has code that collects it.
Android vs iOS
Most banks have an Android app and an iOS app. Same name, same logo, but often built by different teams. We ran the same checks on both apps of every bank that has two.
of banks have at least one check where their two apps disagree
A customer's protection depends on which phone they carry, and an attacker only needs the weaker app.
FIG 8.1
Android apps do worse than iOS apps on 3 of 3 checks
Checks where this platform’s apps do worse
Banks whose Android and iOS code we could both read in full, a smaller group than the banks in Fig. 8.3, whose two apps were scanned. Each row is a problem, so further right is worse.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
Bank by bank
One circle is the banks whose Android app has the problem, the other those whose iOS app has it. In the overlap, both apps have it. Dots outside the overlap are banks whose apps differ: fixing one app leaves the other open.
FIG 8.2
At 80% of banks, the Android and iOS apps differ on at least one check
32 of 100 banks: the problem is in one app and not the other
Each bar is 100 banks: Android only, both apps, iOS only, then neither. The number is the banks whose two apps disagree.
Shown as 100 banks, scaled from the 75 with both apps. Circle sizes are to scale; one dot per bank.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
Twin apps
For 152 banks we scanned both the Android and the iOS app, then compared the two builds of each bank. Both phones fall together. On protections and scan score, each cell is one bank, in the same place on both screens, lit on its stronger app. On critical flaws, each red box is an app with a serious flaw, counted on each platform.
FIG 8.3
54% of banks’ Android apps have a serious flaw, against 34% of their iOS apps
Android54%
iOS34%
Each red box is an app with a critical or high-risk flaw, counted on each platform, not matched bank by bank.
The 152 banks with both apps scanned. Protections: the 9 anti-tampering checks both platforms have. Scan rules differ by platform, so the score comparison is a rough guide.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
Outside the app
Fake apps in the stores, lookalike web addresses, mail anyone can forge, old server settings: an attacker can map a bank from public records before touching its app. We looked at what each one leaves in the open.
FIG 9.1
97% of banks have lookalike web addresses registered, by others or by the bank itself
28%
of banks have apps from other publishers carrying their name in the app stores
Apps in Google Play, the App Store or AppGallery that use the bank's name but come from someone else (the bank's partners left out). Worth a look; not all are fakes.
486 banks checked · Public sources and the banks' public websites. 500 banks, 1,252 bank websites.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
A typical bank has 28 registered web addresses just one small change away from its own. Here is how they are made, on a made-up bank.
FIG 9.2
54% of lookalike addresses are made one way: a missing or doubled letter
The real addressyourbank.com
486 banks checked · yourbank.com is made up, to show how it works. Shares are of 4,132 lookalike addresses, grouped by how each differs from the real one.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
Servers
Every banking app talks to servers: they sign customers in, move money and send alerts. We traced each bank's own servers in its apps to the networks that run them. Most run on a global cloud network (such as AWS or Cloudflare), which can be anywhere; the rest run on the banks' own networks, mostly at home.
FIG 10.1
60% of bank servers sit behind a big global cloud network
Each line goes from the region to a country where its banks' own servers sit. The thicker the line, the bigger the share.
84%
of the servers used by banks in North America are on a global cloud network, which can answer from anywhere
Of the hosts on their own networks, 10% are outside North America.
Hosts on the banks' own networks, by country
392 banks checked · Where the banks' servers are, from their Android, iOS and HarmonyOS apps. Global clouds can answer from anywhere, so countries are shown only for servers on the banks' own networks.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
Most of those servers run on a handful of cloud providers. Pick one and switch it off: each phone is one bank's app, out of 100, and shows what its customers would lose.
FIG 10.2
If AWS went down, 41 of 100 banks would lose part of their app
Every app is up. Pick a provider to take it down.
392 banks checked · Which company runs each bank server named in the banks' apps. 392 banks have at least one such server.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
64% of banks put at least one server behind a provider that sells a web attack filter, or WAF (Akamai, Imperva, Cloudflare or F5).
UK retail banks must report every major incident that stops a service or puts it at risk. Year after year, most are IT failures, not attacks, and many start with a change that went wrong or at a supplier.
FIG 10.3
UK retail banks reported 3,271 major incidents since 2018; only 147 were cyberattacks
How they started, across all incidents
Whole banking sector, no bank named. "Third party" and "change" show where an incident started. *2026 up to 9 July, not final.
Source: UK Financial Conduct Authority, major operational incidents reported by retail banks (FOI2026/01239)
Public reports and regulators logged banking outages in 33 countries since 2025; the longest took a bank's mobile app down for about 48 hours.
On the attackers' lists
Banking trojans are malware that steal logins. Each one carries a list of the apps it can copy: when a listed app opens, the trojan shows a fake login screen on top. Security researchers publish these lists, and we matched them to the banks in this report.
FIG 11.1
The most common banking trojan targets the apps of 35 of 100 banks
50 of 100 banks are on at least one trojan's target list. 34 on three lists or more.
A red badge is how many trojan families list that bank’s app. Tap an app to open it.
389 banks checked · 47 lists of apps targeted by banking malware, published by security researchers from 2019 to 2025, matched to the banks' Android apps. On a list means targeted, not infected. Each phone is one unnamed bank: 100 banks picked so the shares match all 389.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
Only 2 attack campaigns this year used altered copies of real banking apps (GoldFactory and Hirudo). The rest used fake lookalike apps, or fake screens shown over the real app.
Case files
Security researchers reported these attacks on banking customers this year. Each file walks through one attack, then compares it with what we found in the apps. Neither the sources nor we name any bank.
Android banking trojan
Hirudo goes further than fake screens over the bank’s app. It removes the real app and installs a tampered copy that lies to the app’s own security checks.
Source: ThreatFabric, October 2026How it works
What fraud costs
App weaknesses are one side of the story; money lost is the other. These numbers come from regulators' published tables, not our tests. They describe the market, not any bank we scanned.
FIG 12.1
In the EU, customers carried €66 of every €100 lost to payment fraud themselves
Across all payment fraud in the EU, customers carried €66 of every €100 themselves.
EU: the European banking authorities' 2025 fraud report, 2024 data, money lost after recovery, by who paid. UK: the payments regulator, refunds for scams where customers were tricked into paying, 7 October 2024 to 31 March 2026. The cost is split equally between the sending and receiving bank.
Source: EBA and ECB, report on payment fraud (2025); UK Payment Systems Regulator
Card fraud, split by how the payment was approved and where the money went.
FIG 12.2
Card payments without a strong identity check had 1.9× as much fraud
Each pipe carries the same €1 million of payments from customers to the people and shops they pay. The gold that leaks out on the way is what fraud took, collected in the glass under it.
Customers pay €1 million down each pipe
Card payments in 2024. Source: EBA and ECB 2025 fraud report.
Source: EBA and ECB, report on payment fraud
In the UK, the regulator publishes how much scam money each firm's customers send, and how much lands in its accounts. A firm far above the line takes in much more than it sends: criminals use its accounts to collect money.
FIG 12.3
3 of the UK’s 11 largest firms take in more scam money than their customers send
3 of 11 firms receive more scam money than their customers send
UK payments regulator, 2024 scam data, before the refund rules of 7 October 2024. 11 of the 14 largest banking groups, those that both send and receive. Firms are not named.
Source: UK Payment Systems Regulator, scam payment data
FIG 12.4
88% of the money reported lost to scams was paid back
88% of the money reported lost was paid back
UK payments regulator: scam refund claims from 7 October 2024 to 31 March 2026. Share of the claimed money paid back; it doesn't say how many claims were paid in full, in part or not at all.
Source: UK Payment Systems Regulator, scam payment data
Fraud is where app security turns into money. The protections in chapter 1 are the part of this a bank controls.
Rules and maturity
Banks have different regulators, very different sizes, and different ways of dealing with security researchers. We compared each of these with what we found in their apps.
FIG 13.1
App security by regulator, and for the biggest banks
India (RBI) has the fewest apps with a critical finding: 8%, against 18% for all banks.
444 banks checked · Banks are grouped by their home country's regulator; the world's biggest banks also form their own group. Critical flaws and passkeys: share of apps. Tampering checks: share of the Fig. 2.1 checks a typical app has.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
Some signs that a bank takes security seriously are public: a security.txt file telling researchers where to report, a disclosure policy, a bug bounty that pays for reported flaws, a certification on its website. Pick one to split the banks in two and compare their apps.
FIG 13.2
Banks with a critical finding, with and without each signal
21 points fewer banks with a critical finding when they have a security.txt file.
444 banks checked · The 444 banks with a scanned app. Each sign comes from public sources: the bank's website, its security contact file, public bug bounty programs and the certifications it claims.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
10% of banks had a publicly reported breach in the last five years, found in breach databases, ransomware leak sites and regulator filings.
Year over year
Every app we tested in each year. Lower is better on every row.
FIG 14.1
3 of 4 measures improved between 2025 and 2026
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
The most serious flaws in a single app: 19 in 2025, 18 in 2026.
Checks we report for the first time. The 2025 report gave no share for them, so there is nothing to compare yet.
FIG 14.2
59% of apps store sensitive data unprotected on the phone
Android apps, Ostorlab scan: apps with at least one such flaw, low risk or above.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
The same measures as the 2025 report, one year on. Most describe the apps rather than flaws, so read them as change, not better or worse.
FIG 14.3
The same measures, 2025 to 2026
2025 figures are from the 2025 report.
Source: Ostorlab analysis of 2,690 banking apps from 500 banks, 2026
Method
Two sources. The apps themselves, read and scanned by Ostorlab: four of the five cards below. And public information, the third card: store pages, the banks' websites, threat reports and regulators' tables.
What each app is built with: frameworks, add-on code, permissions, servers, defences. All apps.
Issues found, rated by risk, matched to the OWASP mobile standard. All apps.
Store pages, rankings, certificates, threat reports and the banks' public websites. All banks.
Code checks for unlocked phones, fake phones, tampering tools and rebuilt copies. Android.
Sign-in, payment and scam protections found in the code. All apps.
Scope. Only the public store versions of the apps, read without running them.
We scanned banking apps on Android, iOS and HarmonyOS (Huawei AppGallery).
Store pages read from 28 October to 9 November 2026.
54 pages: every chart, the case studies, the results by region and how we tested.
