HSBC decides Samsung Secure Folder and Android's Private Space are no place for a banking app

HSBC has blocked its Android app from running inside Samsung Secure Folder and Android Private Space without warning, leaving some customers unable to access online banking.

The Register asked HSBC to explain the change.

It said the block was "a proportionate security control designed to mitigate a foreseeable security risk.

It does not prevent customers from accessing the HSBC UK Mobile Banking app – customers simply need to access our app outside of the virtual space environment." When we asked why, HSBC said: "For security reasons, our mobile banking app cannot be used within certain protected private space and virtual space tools, which could prevent or limit the identification of certain threats, or from sending timely fraud notifications." One reader who installed the app in Samsung Secure Folder said they received no advance warning and felt "held hostage from my own account." The app now displays a generic message about a security problem with the device and offers only the option to quit.

Samsung Secure Folder uses the company's Knox platform to isolate and encrypt apps and data behind separate authentication.

Android's Private Space, introduced with Android 15, similarly places selected apps in a separate profile that can be hidden and locked.

Our tipster said the block also prevented them from using web banking because HSBC required the app for multifactor authentication.

They said no alternative access method had been arranged before the change.

Reviews on Google Play describe similar experiences.

One Android user said the app had stopped launching from Samsung Secure Folder because HSBC deemed it "an unsecured virtual environment." The reviewer called the decision particularly baffling because they had put the banking app there for additional protection.

Another reviewer said they had been cut off from their account after the app stopped opening in Secure Folder.

They claimed they could not activate another installation outside it because doing so required a code from the inaccessible copy.

Responding on the Google Play reviews page, HSBC asked both reviewers to contact it privately.

Customers acknowledged that the bank may be trying to mitigate a security risk, but questioned why it did not warn them before removing support.