HSBC has prevented its UK Android banking app from running inside Samsung Secure Folder and Android's Private Space. The Register reports the change came without prior notice to customers. HSBC described it as "a proportionate security control," saying virtual spaces could limit threat identification or prevent timely fraud notifications.
Customers affected say they were not warned and were locked out of both the app and web banking because the app was used for multifactor authentication. Some say they cannot activate a new installation without a code from the inaccessible copy, and waiting for a physical security key could take five to ten working days. HSBC says customers who try to access the app in those spaces are informed it is not allowed, but reviewers and Reddit users dispute that any advance communication happened.
The move echoes an earlier incident this year when HSBC flagged sideloaded Bitwarden installations. F-Droid board member Neil Brown was locked out until he removed the app. Affected customers acknowledge the bank's security rationale but question the lack of warning and whether it meets FCA guidance on advance communication and handling technical problems that prevent account access.