HSBC locks its app out of Android's secure spaces

If you bank with HSBC UK and keep its app tucked inside Samsung's Secure Folder or Android's Private Space, you may already have found out the hard way: it no longer works there. The bank has blocked its Android app from running inside both features, and customers say it did so without any warning. The Register reported the change on 24 September and HSBC UK has confirmed it.

The irony is hard to miss. Both features exist to make a phone more secure. HSBC says they make it less so.

For security reasons, our mobile banking app cannot be used within certain protected private space and virtual space tools, which could prevent or limit the identification of certain threats, or from sending timely fraud notifications.
— HSBC, speaking to The Register

What Secure Folder and Private Space actually do

Samsung's Secure Folder is a walled-off area on Galaxy phones. Apps inside it are kept apart from the rest of the device, behind their own lock. Android's Private Space does a similar job on other Android phones. Plenty of people use them precisely for banking apps: if someone gets into your unlocked phone, your bank is still behind a second door.

HSBC's app now spots when it's running inside one of these spaces and stops. According to The Register, users get a generic security error with no option except to quit. The bank describes the block as "a proportionate security control designed to mitigate a foreseeable security risk."

No warning, and a lockout that spreads

The complaint isn't just the block. It's the way it arrived. Customers told The Register they had no advance notice, and SamMobile and Sammy Fans both report that the change only came to light when people started complaining they couldn't get in.

For some, the effect went further than the app. If you use the HSBC app to approve logins to online banking on a computer, losing the app means losing that too. One customer told The Register they felt "held hostage from my own account."

HSBC's suggested fixes are to reinstall the app outside the protected space, or to use a Physical Secure Key, the bank's little code-generating gadget, for desktop banking. The Register reports that getting a key can take several days. HSBC UK's spokesperson said that customers who try to use the app in these spaces "are informed that to help protect their accounts, they will not be able to access the HSBC UK mobile banking app within private space and virtual space tools."

A pattern, not a one-off

This is the second time in 2026 that HSBC UK's app has decided what else is allowed on your phone. In January, The Register reported that the app was locking out customers who had installed the Bitwarden password manager from F-Droid, an alternative app store, rather than from Google Play. At the time HSBC said its app "performs checks to identify potential malware risks and can require users to take additional steps".

There's a broader UK point here. Banks are under constant pressure to cut fraud, and they increasingly do it by checking the phone itself. That's reasonable up to a point. But when a bank starts ruling out mainstream security features built by Samsung and Google, customers who have done the sensible thing end up worse off than those who haven't. It sits awkwardly alongside other efforts to make phones harder to raid, such as Apple's anti-snatching AutoLock feature.

SamMobile and Sammy Fans both note that other banking apps still work inside Secure Folder, which makes HSBC look like an outlier rather than the leading edge. Sammy Fans also points out it isn't clear yet whether HSBC's apps in other countries are affected.

To be fair to HSBC

There is a real argument buried in the bank's statement. A banking app that runs inside a separate, isolated space may not be able to see what else is running on the phone, which is one of the ways banks try to spot malware and remote-control scams. If fraud alerts can't get through reliably, that's a genuine problem too. HSBC hasn't blocked Android, Samsung phones or its app generally: the app still works as normal outside these spaces, and the bank has offered a desktop alternative. The block may be defensible. Springing it on people without notice isn't.

Mind the hype. Lock your banking app in a safe, and your bank may lock you out of it.

Sources: The Register, SamMobile, Sammy Fans, The Register (Bitwarden, January 2026)