How to Develop a Secure Neobank Like Revolut

Developing a neobank upon an existing framework is both a time and cost-effective approach. Yet, it makes an app dependent on the functionality and security protocols the framework has in place. That’s why careful consideration of security measures and comparison of neobanking platforms on the market by this factor is a must. 

In this post, you’ll discover how to establish fintech mobile app security and what are the consequences of not having strong security measures in place. Moreover, you’ll explore the comparison of Revolut and a Fintech Core-based mobile neobanks by the security protocols they have in place. 

How to Establish Mobile Application Security

Mobile application security is the practice of protecting mobile apps from vulnerabilities and threats through a set of security measures.

In the context of the development of a neobank upon an external platform, there are several key aspects of security, including:

Protection Against Jailbreaking

Jailbreaking is the process of removing software restrictions imposed by the operating system. This allows users to gain root access to the device’s file system and manager, enabling the installation of unauthorized apps. Jailbreaking can offer more customization options but it also exposes the device to security risks by bypassing built-in protections.

Jailbreak protection is a security measure implemented in mobile applications to detect and prevent the app from running on jailbroken devices. By implementing jailbreak detection, the app can prevent its execution on compromised devices, thereby protecting sensitive user data and financial information from potential breaches. The jailbreak protection procedure may include the following processes

• Utilization of detection mechanisms
• App termination
• User and admin notification

You can discover extra details on jailbreaking iOS device from another blog post by DashDevs. 

Application Version Check

App version check is a security measure used to ensure that users are running the latest version of a mobile application. Basically, if the version is outdated, the application should not allow authorization. 

By enforcing a version check, the application prompts users to update to the latest version, thus ensuring they benefit from the most current security protections and features.

Proper Use of Keychain

The Keychain provides a secure environment for storing sensitive data, such as passwords, biometric encryption data, cryptographic keys, and more. It leverages strong encryption to protect data from unauthorized access.

Keychain provides an essential level of security to a neobanking app. It allows to implement of authentication methods of two-way authentication to all forms of biometric authentication. Here is what the Keychain provides:

• Secure storage
• Biometric integration
• Data encryption

Protection Against Network Attacks

Using HTTPS to protect data during transmission is another fundamental security practice for neobank applications. HTTPS encrypts the data exchanged between the user’s device and the server, preventing interception. This encryption ensures that sensitive information, such as financial transactions and personal details, remains confidential and secure from network sniffing attacks. 

Enforcing HTTPS for all communications, the neobank application can significantly reduce the risk of data breaches and maintain the integrity and privacy of user data.

Secure API Communication

Mobile applications, in particular, neobanking solutions, are normally built with the involvement of multiple APIs. That’s why maintaining the integrity and confidentiality of data exchanged between the neobank application and external services is another key security concern. 

By securing API endpoints and employing robust security measures, the neobank application can prevent unauthorized access and data breaches ensuring that only legitimate and authenticated requests are processed.

You can discover about banking APIs and open banking APIs from another blog post by DashDevs. 

Consequences of Having Security Issues in Mobile Fintech Apps

Insufficient mobile application security, especially in such an app as a mobile neobank, can lead to adverse consequences for both users and developers. Jailbreak protection is one of the cornerstones of the entire security mechanisms of apps like Revolut and neobanks built upon Fintech Core. So, let’s review the outcomes of not having jailbreak protection in place:

The absence of jailbreak protection can lead to serious security issues:

• Network sniffing: Attackers can intercept network traffic, allowing them to access confidential data transmitted between the application and the server.
• Bundle theft: Attackers can gain access to the contents of the application, including important files and resources.
• Sandbox (database) vulnerability: If the database is not encrypted with biometric data, attackers can access all data stored in the application.
• Access to Keychain: Compromising the application can grant attackers access to confidential information stored in Keychain, including passwords and other secrets.

Now that we understand what security issues can arise when jailbreak protection is absent, let’s consider the critical consequences of having a jailbreak and other security issues: 

Money Theft

Money theft is a significant risk posed by inadequate mobile application security. When security mechanisms like jailbreak protection are absent, attackers can exploit vulnerabilities to deploy malware or conduct phishing attacks. It allows them to steal funds directly from users’ bank accounts. 

Over £1.2 billion was stolen by criminals through authorized and unauthorized fraud in 2022 in the UK. It should that money thief is still is substantial concern that is not to be taken lightly. 

Data Theft

Data theft is another critical risk associated with insufficient security in mobile neobanking apps. Here are the types of data that can be stolen:

• Card numbers
• Passwords
• Users’ personal information
• Sensitive financial information
• Biometric data
• Customer support and other messages sent through the app

Such data is often used for conducting money theft. Additionally, stolen financial data can also be used for blackmail, threatening both individual users and companies.

As an example, back in 2020, Dave, a US-based neobank suffered a data breach that exposed the personal information of 7.5 million users. The breach included names, emails, birthdates, physical addresses, phone numbers, and social security numbers.

Non-Compliance with Standards and Regulations

There is a suite of standards and regulations that dictate neobanking mobile apps how to handle financial and customers’ sensitive data. They obligate companies to have strict security measures in place. Examples of some regulatory frameworks include:

• General Data Protection Regulation (GDPR)
• Payment Service Directive (PSD3)
• Payment Card Industry Data Security Standard (PCI DSS)
• Anti-Money Laundering (AML) Regulations

Failure to comply with these regulations leads to fines. For example, failure to comply with GDPR provisions can result in fines of up to €20 million, or 4% annual global turnover – whichever is higher. It also can damage the company’s reputation.

For instance, in September 2021, German neobank N26 was fined €4.25 million by the German financial regulator BaFin for delayed reporting of suspicious activities related to money laundering.

Revolut vs Fintech Core-Based Neobank: Comparing Security Systems Protection

Let’s first familiarize with the subjects of the comparison:

Revolut is a global financial technology company. It has a neobank — Revolut. It also offers to integrate banking capabilities in external apps based on their SDK.

At the same time:

Fintech Core is a modular while label fintech solution for the fast creation and launch of neobanking apps for mobile or web. It has pre-integrated modules and providers to choose from while crafting a ready app. 

You can explore extensive details on Fintech Core and how it can be used for neobank mobile app development on the corresponding DashDevs product page. 

Сonsidering modern security concerns, it’s crucial to evaluate protection measures of digital bank apps, taking a examples the Revolut app and a neobank that can be created upon Fintech Core. 

An Overview of Revolut Security Protection

Here are the main security protocols that Revolut app has in place:

• Protection against jailbreaking and application version checking during authorization: The Revolut application employs effective detection mechanisms to guard against jailbreaking. Additionally, it implements checks of the application’s version’s validity during authorization, which ensures that the user can only utilize an updated version with all necessary security measures.
• Protection during new device authorization: When attempting to authorize a new device, users are required to undergo verification using facial recognition. However, it should be noted that this protection can be circumvented by substituting one’s own photo with the user’s photo.

Protection against jailbreaking in the Revolut application plays a main role in ensuring its security. This protection prevents the application from being used on devices with modified operating systems, thus ensuring the reliability and confidentiality of financial data and transactions.

An Overview of Fintech Core Security Protection

Any neobank app built upon Fintech Core, white label banking solution by DashDevs, employs the following security protocols: 

• Jailbreak protection: The Fintech Core-based apps exploit a jailbreak detection mechanism that effectively prevents users from accessing an app from a modified device. It terminates any authorization attempt ensuring that no security breach and unplanned neobanking app modification is possible. 
• Keychain protection: The data contained in apps built upon Fintech Core are stored in the keychain and encrypted with the user’s biometric data. This provides an additional level of security and confidentiality for personal information, preventing the data to be exposed in case keychain is dumped.

Fintech Core security is grounded on keychain protection, which makes it nearly impossible for hackers to access users’ accounts and data. This white-label, modular solution for building neobanks also has same jailbreak protection as Revolut does, ensuring completely compliance with the most stringent standards and requirements. . 

Revolut and neobanks built upon Fintech Core feature different approaches to ensuring security. Yet, both have jailbreak protection in place. The secureness of both software solutions intended to create neobanking apps upon them is undisputed. 

Looking for a provider of mobile app development services? Don’t hesitate to reach out to DashDevs. 

All Security Measures You Can Implement in Your Neobank with FintechCore

Important note: It’s essential to understand that the mention security protocols of Revolut or a nonbank build with Fintech Core, don’t constitute the entire suite of protective measures. Jailbreak, authorization protection, or keychain protection are just the primary security protocols. At the same time, the completed neobanking app will have other security protocols integrated, depending on the choice of pre-built modules and providers.

Here’s a complete list of security measures that can be implemented in ready neobank built on Fintech Core:

• Keychain data encrypted with biometrics
• Jailbreak protection
• HTTPS communication protocol
• Two-factor authentication
• Biometric authentication
• Fraud detection algorithms
• Session timeout 
• OAuth 2.0 for API security

With Fintech Core, you can choose from dozens of pre-integrated modules and functionalities to include in your neobanking mobile app. The DashDevs team will assist you with establishing security measures, ensuring your ready solution meets strict security requirements and both global and region-specific standards.

Discover more about Fintech Core and how is it different from Revolut from another our comparison blog post. 

Final Take

If you want to create a neobank solution using a pre-built banking framework, it’s essential to focus on the security measures provided by this framework. Both Revolut and a neobank built with Fintech Core can offer reliable security measures integrated. Additionally, Fintech Core offers a complete suite of protective protocols, depending on the modules you choose to integrate.

If you choose Fintech Core for developing your neobank, you can rest assured that your app will be well-protected from cyber attacks and malicious intrusions. Do you want to learn more about developing a neobank using FintechCore? We will be to answer all your questions. Contact us to schedule a call!

Contact us