BBVA Perú

[tecncr]

Is there an existing issue for this?

• I have searched the existing issues

App name

BBVA Perú

Link to app

https://play.google.com/store/apps/details?id=com.bbva.nxt_peru

App version

24.20.11

Country of the app

Peru

Build Number

2024030300

Device list

Pixel 6 Pro

Profile app tested in

Owner profile

Google Play installed?

Installed

Where did you install this app from?

Google Play Store

Google Play services Network permission revoked?

• Revoked
• Not revoked
• I did not have Google Play services installed

Native code debugging

• Allowed
• Blocked

Exploit protection compatibility mode

• Enabled
• Disabled

Stock OS compatibility

• Works
• Does not work
• Not tested

NFC payments

• Works
• Works but requires another service
• Does not work
• N/A (Not supported by app)
• Not tested

Description of the app's functionality

Peruvian branch of the well known spanish bank. App features: opening bank accounts, wire transfers, bill payments, and instant mobile payments via phone number or QR code (Plin), NFC payments.

Tested working:

• Opening a bank account.
• Sign in, facial and DNI validation.
• Bank transfers (between BBVA accounts and other banks).
• Plin (mobile payments).
• Enabling/disabling cards.
• Generating dynamic CVV.
• Digital Token (for authorizing operations).
• Biometric (fingerprint) login.
• Push notifications.

Tested not working / broken, even with Exploit protection compatibility mode enabled:

• NFC Payments (option is disabled in menu).

Are there any extra notes you think users should know about?

Sadly, it seems that NFC Payments might require passing Play Integrity's MEETS_STRONG_INTEGRITY check (if I'm wrong or anyone else has updates on this please comment below).

NFC Payments were tested with another phone running LineageOS without success, using the Play Integrity Fix by @chiteroman Magisk Module with a valid fingerprint to pass the MEETS_DEVICE_INTEGRITY check, after that, Google Wallet allowed NFC payments, but the option in the BBVA app was still disabled.

ADB logcat of the app if necessary

No response

[spring-onion]

Make sure to point them to the attestation compatibility guide too.