back
230 comments
That's Google's SafeNet. HSBC picked a level that causes this. Google manages the blacklist of apps.

We are rapidly losing our freedoms to the will of these companies. If they decide they don't want to they can even if the law doesn't forbid it.

People in Switzerland and the EU are being de-banked by local banks because of US pressure allowing them to force any bank that wants to use USD. The US has started to sanction people for free speech resulting in de-banking.

Swiss law requires one bank (Postfinance) to offer banking irregardless but if you are sanctioned you can't use the wire system, no other currencies, no credit cards and you cant use Twint either so it's in effect useless. You can't pay for your health insurance or rent.

At least in Switzerland banks can choose to not use Play Integrity, but they generally don't want to.

Yuh, which once was owned by both Postfinance and Swissquote, works without Play Integrity. Support for GrapheneOS is confirmed - see https://github.com/PrivSec-dev/banking-apps-compat-report/is...

The real issue is that most "legacy" banks have to comply with stupid regulations that force them to come up with these stupid solutions.

Banks are lazy and find the quickest way to comply with said regulations - simply by enabling Google Play Integrity.

About the whole US thingie - yes, that's true, and it's what happens if you get sanctioned. I'm pretty sure russians (and other people from sanctioned countries) have similar limitations elsewhere. In Switzerland US nationals have huge problems in opening accounts because of the whole bank secrecy law that allowed many americans to hide money from the IRS in Switzerland.

> and the EU are being de-banked by local banks because of US pressure allowing them to force any bank that wants to use USD

What is this about? I'm a EU citizen, never heard about any EU citizen getting removed from any EU bank because of USD. Nor have I heard anyone being sanctioned by the US in the EU unless they're Russia-related somehow. Is there any link to a story about this?

> We are rapidly losing our freedoms to the will of these companies

which companies? google? I'm the first to blame them for almost anything, but how about Postfinance, twint, health insurers, landlords, all those companies you mention? shouldn't they offer ways to do business with them that does not involve some third party? - for example, OP mentions that hsbc website still works for them on android, this is more than what can be said of other banks that basically removed certain "sensitive" features from their homepages. Or practically all the neobanks who 100% rely on apps.

Even those governments you mention: how hard/easy do they make for citizens to engage in commercial activity without relying on third parties or adversarial systems?

I know the argument used by all of them - companies, governments: we are just "following the rules enforced on us (as interpreted by our lawyers)".

Everyone goes to the "simplest" target - Google in this case - to blame for the status quo, but Google is in this position because everybody else - consumers, companies, governements, etc - buys into the "convenience" and neglect everything else.

Since this year, I have two phones:

1) An iPhone Se 2022 that I use for TOTP, banking and auth. It is always in airplane mode, unless I need to login to banks (etc). The OS will receive security updates till 2032.

2) A Pixel phone with GrapheneOS for daily use: Internet browsing, routing, phone, message etc.

I found this is the only usable way in 2025.

I can't find anything about this in the API docs for neither the old SafetyNet nor its replacement (Play Integrity), can you show a source for this being related to SafetyNet? I'd like to see Kore details on this API and the apps it blocks.
It's more insidious than that. The US is actively working on dismantling the Swiss off-shore banking system. It started with US clients and expanded from there (see: https://www.privatebankerinternational.com/news/hsbc-swiss-p...)

Guess where all these un-banked HNWI are going and who is offering them a gold card to run their businesses from?

Do you think US pressure is behind the push for online censorship across the West? It seems to be a coordinated effort in many countries, whatever it is.
> HSBC picked a level that causes this. Google manages the blacklist of apps

What is Google's rationale for flagging Bitwarden?

An Italian citizen who was debanked essentially because Trump didn't like her:

https://english.elpais.com/international/2025-12-28/the-comp...

When it comes to this kind of thing, an injury to one is an injury to all and we need to not tolerate it. At minimum, we need regulations guaranteeing that Visa and MasterCard, as well as participating banks, aren't allowed to debank anyone without judicial oversight. Make the same true of apps: call it a Banking Access Tribunal.

> People in Switzerland and the EU are being de-banked by local banks because of US pressure allowing them to force any bank that wants to use USD

That's not quit accurate.

American citizens will indeed have a very hard time to open a bank account in Switzerland. But the reason is not so much free speech than FATCA (Foreign Account Tax Compliance Act) [0] [1]

The requirements to host bank accounts for Americans are so onerous that banks rather forgo business with such clients than having to deal with the legal mess it incurs.

Another reason for a bank not wanting to deal with customers are if they are on a sanctions list. People winding up on such lists usually don't do so, because they said something nasty about Mr. Trump.

This, alas, may change if you look who got sanctioned in recent times just for raising the ire of the president (such as EC commissioners or ICC judges).

[0] https://home.treasury.gov/policy-issues/tax-policy/foreign-a... [1] https://en.wikipedia.org/wiki/Foreign_Account_Tax_Compliance...

>Swiss law requires one bank (Postfinance) to offer banking irregardless but if you are sanctioned you can't use the wire system, no other currencies, no credit cards and you cant use Twint either so it's in effect useless. You can't pay for your health insurance or rent.

What's funny is that this particular jurispudence was actually enforced due to a Russian oligarch (Vekselberg) on a C permit.

I am not sure regarding the rent and the health insurance, the health insurance especially as it is a legal requirement.

>The US has started to sanction people for free speech resulting in de-banking.

The sanctioned people were "hate-speech" fighters. Which is the most Orwellian branch of Brussels machinery. While it irks me on pure power level, you could hardly imagine people more deserving to be taken couple of pegs down.

I can confirm that the Postfinance app doesn't work on graphene. I left some feedback and they said they're working on it so maybe there is hope. But as such I need to keep an old iphone around for banking apps.

Also being an American in Switzerland trying to do banking is eye opening. Local banks mostly tell you to pound sand when they find out you're American. Regardless of this or that administration, the US is really totalitarian when it comes to finance and taxes.

To play devil's advocate for a moment, could this not be a risk?

Is Google implementing a rule which blockes any 3rd party app which wants access to things like the keystore (which could be reasonable), or are they deliberately blocking Bitwarden?

Here on HN I will be downvoted to oblivion but well... let's be it:

There is no other way for us mortals than to go back to cash... Or start using Bitcoin. Be your own bank. Vote with your money.

"sanction people for free speech"

Not sure how this is the top post on this thread, no links nothing but misinformation and FUD.

What happens in Switzerland to non US citizens is not a free speech issue no matter how you want to twist it.

Plenty of UK banks that don't require this, and whose apps will also work on a rooted device. Monzo will display a warning that sets out the fact there's an increased risk, and then lets you be an adult and choose to continue to use the app if that's what you want to do.

The best part is that the Current Account Switching Service makes it very easy to make the jump from a legacy bank like HSBC.

This was not my lived experience. I wanted to use the most common banks and most would not let me use it.

Chip contacted me at one point via their live assistant randomly without my doing and told me to stop using the app because they would soon be enforcing that rooted devices would no longer work. I continued to use the app rooted and nothing came of it.

Barclaycard, Nationwide and others don't let you use the app or require some circumvention of their detection to allow access.

Sure there are plenty of other apps, but those apps and banks have a worse product I found.

They've all started cracking down, in the past year the Barclays and Lloyds app have broken on my phone.

TSB still works for now, but even for a bank they're technologically incompetent so I'm going to just assume they're behind the curve rather than willingly not using SafetyNet.

The only one I would bank on still working in the future is Monzo, since, like you say, they detect it and just give you scary warning and let you continue.

If you've ever built a website for mobile but never heard of PWAs (Progressive Web Apps), I recommend checking them out. In essence, adding 2 files can make the site installable from a mobile browser and define caching behavior for offline functionality.

1. manifest.json: a JSON file that defines the app's name, icons, theme colors, and how it should launch when installed.

2. Service worker: a JS file that controls things like resource caching for offline usage

Unfortunately PWAs don't receive first class support compared to native apps. Still, I still hope to see wider adoption. I think for many not-too-complex apps, they can significantly lower the cost of development, and the development experience could be as simple as

- Building with HTML + JS + CSS. No clunky SDKs, reduced need to test on painfully slow emulators or expensive physical devices

- Installable from a browser. No need to maintain a listing in the Playstore/App Store, avoiding policy headaches, rent, etc.

https://developer.mozilla.org/en-US/docs/Web/Progressive_web...

My wife has tried to use a flip phone just for nostalgia's sake and she has a newer phone that supports android 14 (technically android go 14) and thus should work with most basic apps. However, one of her banking apps refuses to work claiming an app is screensharing (the POSB bank app thankfully identifies it as the "android system" app.) likely what is occuring I think is the second screen is drawn using some sort of thing that is reported as screen sharing, that POSB thinks could be malware.

Of course, asking POSB for help has lead to nothing being done. By and large the biggest threat to people finance wise in singapore isn't malware but are scams (what is called "pig butchering" in America is rampant here) whilst malware is always a threat sometimes I feel like just refusing to function is problem due to overzealous viligiance to a low probability threat.

Ditch apps on your phone and pick banking that gives good, robust online banking. I was cut off by Starling for something similar and had to choose between a factory reset of my phone and my bank. I explained that my phone had free software on it, some of which I'd written, and it made no difference.

Apps are a tool of control and surveillance and it is time we stopped tying ourselves to them. Dumb phones or degoogled operating systems (like e/OS/) are probably the answer here.

HSBC still operate a perfectly functional website for banking.

The more people who continue to use this, the better. It sends a clear signal that customers prefer the open web over restrictive and inconvenient mobile apps.

I’m also hanging on to my bank’s physical RSA fob as my 2FA, instead of using their app based version.

I thought Google removed the API that let you see other apps on the device. Maybe there's another API I'm not aware of though
Tangentially related, but some banking apps also implement their own in-app keyboard in their password fields, making password manager unusable and basically forcing me to use a easy to remember (to guess) password.
It will not work either if you have developer mode enabled.

These things HSBC app does, I think it's overreaching

Isn't it funny how most banking apps do all this borderline malware crap, yet most banks also have online banking that you use through a web browser that they have no technical means of "trusting"?
I recently came across Open Web Advocacy (OWA) who summarize my mobile-platform concerns well. They "advocate for the future of the open web by providing regulators, legislators and policy makers the intricate technical details that they need to understand the major anti-competitive issues in our industry and how to solve them."

Their top 3 priorities:

1. Apple's ban of third party browsers on iOS is deeply anti-competitive

2. Web Apps need to become just Apps. Apps built with the free and open web need equal treatment and integration. Closed and heavily taxed proprietary ecosystems should not receive any preference.

3. All artificial barriers placed by gatekeepers must be removed. Web Apps if allowed can offer equivalent functionality with greater privacy and security for demanding use-cases.

Website: https://open-web-advocacy.org/en/

We can't let banking apps invade our property.. things like banking apps need so much control in order to be secure that they need to exist on dedicated devices.
Two phones: personal and gov id/banking/2fa phone

second phone never leaves home

Bitwarden is installed via F-Droid from the official Bitwarden repository and is a build provided directly from Bitwarden. F-Droid does not provide a build of Bitwarden.
can't wait for digital euro

https://www.consilium.europa.eu/en/press/press-releases/2025...

https://www.ecb.europa.eu/press/key/date/2025/html/ecb.sp251...

i hope it will be part of the digital wallet initiative: https://github.com/eu-digital-identity-wallet

there is an active discussion there on NOT integrating play integrity API or any other US-dependent remote attestation: https://github.com/eu-digital-identity-wallet/av-doc-technic...

Getting a (cheap) dedicated device for banking purposes (perhaps without a sim card, wifi only) is a good way to «work around» this.
HSBC is on my list of the worst bank anyway. Just connecting to their online banking portal you feel like throwing up!
I use a separate phone for non-F-droid apps.
Never use a banking app on a phone especially since internet banking websites exist.
I switched away due to HSBCs final straw for me being blocked due to not using the phone built in keyboard.

Apparently using an open source keyboard runs the risk of my keypresses being shared with a 3rd party. Unlike Googles keyboard?

Most banks do this, they won't let the app run if you have developer mode turned on as well, even if you're not using it for root (or anything else in the developer menu)
Source post deleted
Banks in the UK take partial liability for their customers succumbing to scams, and refund lost funds unless customers go out of their way to ignore warnings.

Loss of control of devices is undeniably part of the scam lifecycle. Faking and intercepting messages from banks is a large part of that. An antivirus needs global permissions.

All of that being true, you don't have to be a contortionist to understand why they might want to lock down client devices as far as they can. Google happens to offer them an easy method.

probably because bitwarden has a permission to overlay other apps and HSBC thinks it's malware stealing your access to your bank
It's worth trying to work around this by creating a work profile to isolate the apps.
404 error
GrapheneOS fixes this
HSBC is also one of few apps that dont let you use it with iPhone Mirroring.
At least now it should be pretty easy for any tech person to patch apk removing this check