HSBC has recently implemented an unexpected restriction on its Android app, preventing it from operating within Samsung’s Secure Folder and Android’s Private Space. This sudden change has left numerous customers unable to access their online banking services, raising concerns about communication and customer support.
Security Measures and Customer Reactions
In a statement to The Register, HSBC characterized the block as a “proportionate security control” aimed at mitigating potential risks. The bank clarified that customers can still access the HSBC UK Mobile Banking app; however, they must do so outside of these virtual environments. HSBC further explained that using the app within these protected spaces could hinder the identification of threats and the timely delivery of fraud notifications.
Feedback from affected customers has been overwhelmingly negative. One user expressed frustration after discovering that their access to the app was abruptly cut off without prior notice, feeling “held hostage from my own account.” The app now displays a generic security error message, offering no alternative but to exit.
Samsung’s Secure Folder utilizes the Knox platform to safeguard apps and data through isolation and encryption, while Android’s Private Space, introduced with Android 15, allows users to hide and lock selected applications. However, the recent block has left some customers unable to utilize web banking, as HSBC requires the app for multifactor authentication. Many reported that no alternative access methods were provided prior to this change.
Customer Experiences and Concerns
Reviews on Google Play reflect similar sentiments, with users describing their experiences of being locked out of their accounts. One reviewer noted that the app ceased to launch from Samsung Secure Folder, as HSBC deemed it “an unsecured virtual environment.” This decision puzzled many, especially since users had placed the banking app in Secure Folder for added protection.
Another reviewer recounted being completely cut off from their account after the app’s functionality was disabled in Secure Folder, stating that they could not activate another installation outside of it due to the need for a code from the inaccessible version. In response to these reviews, HSBC requested that customers reach out privately for assistance, acknowledging the potential security risks while facing criticism for the lack of prior communication.
Some customers have raised concerns regarding HSBC’s compliance with the Financial Conduct Authority’s (FCA) Consumer Duty, which emphasizes the importance of informing customers about changes in advance. One Reddit user pointed out that the abrupt nature of the change left them unable to use the personal banking app, arguing that the bank’s actions conflicted with its obligations to communicate effectively with its clients.
HSBC’s Response and Future Communication
In light of the situation, HSBC’s spokesperson indicated that customers attempting to access the app within private or virtual spaces would be informed of the restriction aimed at protecting their accounts. This is not the first instance of HSBC’s mobile security measures causing customer lockouts; earlier this year, users were similarly affected when the app flagged sideloaded installations of third-party applications as potential risks.
Customers now face a dilemma: they can either install the HSBC app in the main profile of their phone—something that may not be feasible for everyone without an authentication code from the previous installation—or wait several days for a new authentication method to access desktop banking. While a Physical Secure Key (PSK) is an option for desktop access, obtaining one could also take additional time.
HSBC’s spokesperson reiterated that customers should use the app outside of Samsung Secure Folder and mentioned that those unable to access the app could utilize a PSK for desktop banking. As the situation unfolds, customers remain hopeful for clearer communication and more robust support from their banking provider.
