HSBC blocks its banking app inside Samsung Secure Folder and Android Private Space

HSBC has blocked its Android banking app from running inside Samsung Secure Folder and Android's Private Space without warning, leaving some customers unable to reach online banking. The Register reported the change on September 24.

A "proportionate security control"

HSBC called the block "a proportionate security control designed to mitigate a foreseeable security risk," saying that customers "simply need to access our app outside of the virtual space environment." The bank says the app cannot run inside certain private space and virtual space tools because they could prevent or limit the identification of threats, or the sending of timely fraud notifications.

Samsung Secure Folder uses the company's Knox platform to isolate and encrypt apps and data behind separate authentication. Android's Private Space, introduced with Android 15, places selected apps in a separate profile that can be hidden and locked.

Customers: no warning, no access

One reader who installed the app in Secure Folder received no advance warning and said they felt "held hostage from my own account"; the app now shows a generic device security message and offers only the option to quit. Because HSBC required the app for multifactor authentication, this customer's web banking was cut off too, with no alternative arranged beforehand.

Google Play reviews describe similar cases: the app stopped launching from Secure Folder because HSBC deemed it "an unsecured virtual environment." One reviewer called the decision baffling, since they had placed the banking app there for extra protection.

Regulatory questions

Customers accept that the bank may be mitigating a security risk, but question why support was removed without warning. One argued on Reddit that the silent change may conflict with HSBC's obligations under the FCA's Consumer Duty, whose guidance expects banks to explain changes in advance and to have processes for technical problems that block account access. An HSBC UK spokesperson said customers who try to use the app inside such tools are told they cannot access it there.

What affected users can do

The choices are to install the app in the phone's main profile — impossible for some customers without an authentication code from the old installation — or wait five to ten working days for another method of reaching desktop and web banking. A Physical Secure Key (PSK) works for desktop banking, but can take several days to arrive if the customer does not already have one. It is not the first such lockout: earlier this year HSBC flagged a sideloaded copy of Bitwarden as a potential risk, and F-Droid board member Neil Brown lost access. The Register has asked Google and Samsung for comment.