I decided to use a banking application (provided by german postbank), but ONLY to SEE my account transactions, so I do NOT want to make any new transactions, just VIEW them.

Im always logging out of my account. But still I'm wondering how safe this use-case of mine is. Imagine my phone gets stolen >> What is cached on my phone by this app?

Is it like I would have never logged in, i.e. no cached data of my downloaded transactions exist on my phone? Or is it that my transactions will get downloaded and cached in a (maybe simple unencrypted?) database on my phone and "everyone" could access it?

How could I check this myself? Thanks in advance!

  • 2
    Is your device rooted? Copy the data from /data/data/de.postbank.finanzassistent to your PC and look inside its contents. – GiantTree Nov 9 '15 at 19:46
  • Any other option if it's not rooted? I mean, a hacker could root it on his own and access all the data unfortunately. – tim Nov 9 '15 at 20:04
  • 1
    Possibly an unencrypted backup through ADB might allow you to browse the data as well. You just need to find a way to open it on your PC. – GiantTree Nov 9 '15 at 21:44

What an app stores on your phone is impossible to say without going through the source codes or at least examining the app's data folder.

That being said, valuable information related to banking (balance, account ID, your personal information, log in information etc.) are stored in the servers of the bank since it is actually them who own those information. The app merely accesses them.

As for the log in part, banking apps use a method called hashing. I won't annoy you with all the details but long in short, the reason they can't give you your old password or PIN code when you forget it is that, they don't store it as well. They store its hash. They check the hash of your password to see if it matches the one in their database and you can't reverse engineer a hash to find the password. Therefore as long as you don't choose to stay logged in, no harm can come.

But if you want to delete all personal datas related to any specific app (user data or cache) you can do it like here

Or, you can tell your bank to block every action other than viewing account information on mobile banking application.

Your Answer

