Common Permission Escalation in Banking Apps: Causes and Fixes

Permission escalation occurs when a banking app gains access to device features or data beyond its legitimate scope, often without explicit user consent. In Android, this commonly stems from:

What Causes Permission Escalation in Banking Apps

Permission escalation occurs when a banking app gains access to device features or data beyond its legitimate scope, often without explicit user consent. In Android, this commonly stems from:

• Over-scoped permissions in manifest: Declaring for OTP autofill without implementing proper security controls
• Runtime permission abuse: Requesting ACCESS_FINE_LOCATION continuously instead of only during transaction verification
• Third-party SDK overreach: Analytics or advertising libraries requesting contacts access for user profiling
• Improper permission inheritance: Child activities inheriting excessive permissions from parent components
• Insecure intent handling: Implicit intents exposing sensitive data to other apps

iOS apps face similar issues through:

• Excessive entitlements: Including com.apple.developer.contacts without clear justification
• Background execution abuse: Using background fetch for data harvesting instead of legitimate sync operations
• Biometric bypass: Storing authentication tokens without proper biometric gating

Real-World Impact

Users report permission-related issues as "creepy behavior" or "data misuse" in app store reviews. A 2023 study found that banking apps requesting unnecessary permissions saw 23% higher uninstall rates within 48 hours. Regulatory penalties compound this: GDPR violations average €2.5M per incident, while PCI-DSS non-compliance can result in transaction processing restrictions.

Beyond legal costs, reputation damage is severe. The 2022 incident where a major bank's app was found collecting keyboard logs led to a 15% customer churn rate and $40M in remediation costs.

Specific Examples in Banking Apps

1. SMS Permission Abuse

<!-- AndroidManifest.xml -->
<uses-permission android:name="android.permission.READ_SMS" />

Issue: Reading all SMS messages instead of filtering for OTPs only. Attackers can intercept banking alerts and transaction confirmations.

2. Contacts Harvesting

// iOS: Requesting contacts without justification
let store = CNContactStore()
store.requestAccess(for: .contacts) { granted, _ in }

Issue: Collecting contact lists for marketing purposes, exposing social graphs of wealthy individuals.

3. Continuous Location Tracking

// Requesting background location for non-essential features
requestPermissions(new String[]{Manifest.permission.ACCESS_BACKGROUND_LOCATION}, 1);

Issue: Tracking user movements to infer spending patterns and lifestyle data.

4. Camera Access for Non-Image Features

<uses-permission android:name="android.permission.CAMERA" />

Issue: Accessing camera for QR scanning but also enabling covert photo capture of check deposits.

5. Storage Encryption Failures

// Saving sensitive data unencrypted
val file = File(context.filesDir, "accounts.txt")
file.writeText(plainTextAccountData)

Issue: Storing account numbers or session tokens in plain text accessible to root users.

6. Bluetooth Discovery Abuse

Issue: Scanning for nearby devices to map branch visits and ATM usage patterns.

7. Notification Listener Service

<service android:name=".NotificationListener"
    android:permission="android.permission.BIND_NOTIFICATION_LISTENER_SERVICE" />

Issue: Intercepting all notifications including banking alerts and email previews.

Detection Methods

Static Analysis

• Android: Use apktool to decompile APKs and audit AndroidManifest.xml permissions
• iOS: Check Entitlements.plist for excessive keychain or contact access
• Tools: MobSF (Mobile Security Framework) flags over-permissioned apps automatically

Dynamic Testing

• SUSATest autonomous exploration: Detects permission requests during persona-based testing
• Manual verification: Monitor Settings > Apps > Permissions during typical workflows
• Network monitoring: Burp Suite can reveal data exfiltration through over-permissioned APIs

Code Review Checklist

• Every requestPermissions() call must have clear user-facing justification
• Verify runtime permission checks before accessing protected APIs
• Audit third-party libraries for hidden permission requirements
• Ensure biometric authentication gates all sensitive data access

Fixing Each Example

SMS Permission

// Instead of broad READ_SMS, use SMS Retriever API
val client = SmsRetriever.getClient(this)
val task = client.startSmsRetriever()
// Handle OTP only, no persistent access

Contacts Access

Remove contact permissions entirely. Use account-based referral systems instead of contact harvesting.

Location Tracking

// Request only during transaction verification
if (needsLocationVerification()) {
    requestPermissions(new String[]{Manifest.permission.ACCESS_FINE_LOCATION}, LOCATION_REQUEST_CODE);
}

Camera Security

// Use FileProvider for secure image handling
val photoFile = FileProvider.getUriForFile(context, "com.bank.app.fileprovider", imagePath)

Storage Encryption

// Android Keystore for sensitive data
val keyStore = KeyStore.getInstance("AndroidKeyStore")
val cipher = Cipher.getInstance("AES/GCM/NoPadding")
// Encrypt before storage

Bluetooth Controls

Remove unnecessary Bluetooth permissions. Use geofencing APIs instead of device scanning.

Notification Access

Eliminate notification listener services. Use Firebase Cloud Messaging for legitimate push notifications.

Prevention Strategies

Pre-Commit Hooks

Implement Git hooks that scan for dangerous permissions:

# .git/hooks/pre-commit
grep -r "READ_SMS\|WRITE_CONTACTS\|ACCESS_BACKGROUND_LOCATION" src/
if [ $? -eq 0 ]; then
    echo "Dangerous permission detected"
    exit 1
fi

CI/CD Integration

Use SUSATest CLI in your pipeline:

- name: SUSA Permission Audit
  run: |
    pip install susatest-agent
    susa scan --app target/app.apk --focus permissions

Threat Modeling Sessions

Conduct monthly sessions mapping:

• Which permissions enable which attack vectors
• Data flow from permission-granted features to backend systems
• Compliance impact of each permission category

Developer Training

Mandatory workshops covering:

• Android/iOS permission best practices
• OWASP Mobile Top 10 vulnerabilities related to data exposure
• Secure coding patterns for financial applications

Automated Regression Testing

Deploy SUSATest weekly scanning:

• 10 user personas exercise all permission-dependent features
• Cross-session learning identifies anomalous permission usage
• Coverage analytics highlight untapped permission combinations

This proactive approach catches escalation vulnerabilities before they reach production, protecting both users and institutional reputation.