HSBC has quietly disabled its mobile banking app from running inside Samsung Secure Folder and Android Private Space, leaving some customers unable to access their accounts without any advance warning. The change, which appears to have been implemented without prior notification, has sparked frustration among users who relied on these encrypted environments for added security.

What You Need to Know

HSBC's block stems from concerns that virtual spaces like Samsung Secure Folder and Android Private Space could interfere with the app's ability to detect threats and send fraud notifications. Affected customers cannot use the app for banking or multifactor authentication, and alternative access methods can take 5 to 10 days. The situation highlights a clash between user-driven privacy measures and institutional security policies, with potential implications under the FCA's Consumer Duty.

A Security Measure With Unintended Consequences

HSBC has described the block as "a proportionate security control designed to mitigate a foreseeable security risk." The bank argues that protected spaces can limit the app's identification of threats or delay fraud alerts. Customers, however, point out that placing the HSBC UK Mobile Banking app inside a Knox-encrypted folder was meant to add an extra layer of protection, not weaken it.

Samsung Secure Folder uses the company's Knox platform to isolate and encrypt apps behind separate authentication. Android Private Space, introduced with Android 15, similarly hides selected apps in a separate profile. The Register first reported the issue after hearing from affected users who said the app simply stopped working inside these environments without explanation.

Customer Impact: Locked Out and Disconnected

One reader who installed the app in Samsung Secure Folder said they received no advance warning and felt "held hostage from my own account." The app now displays a generic message about a security problem and offers only the option to quit. The block also prevents those customers from using web banking because HSBC requires the app for multifactor authentication. Without the app, users must request a Physical Secure Key (PSK), which can take 5 to 10 working days to arrive.

  • No advance warning: Customers say they received no notification before the block was applied.
  • Locked out of multi-factor authentication: The app was required to authorize desktop banking access.
  • Delayed alternative access: Obtaining a Physical Secure Key can take several working days.
  • Inconsistent information: Help pages and chatbots lack details about the change, and branch staff could not explain it.

One affected customer argued on Reddit that the lack of warning may conflict with HSBC's obligations under the FCA's Consumer Duty. The FCA guidance requires banks to communicate changes in advance and have processes for technical problems that prevent account access. Another customer said they called to complain and were told the change was intentional policy, adding that they were effectively locked out of banking for up to 10 days.

A Broader Pattern of Security Checks

This is not the first time HSBC's mobile security checks have caused disruptions. Earlier this year, the app flagged sideloaded installations of Bitwarden as a potential risk, locking out users who had installed the password manager from the open source catalog F-Droid. In that case, HSBC said access would be restored if the sideloaded app was removed. The current block appears to be a more sweeping policy applied to virtual spaces without prior notice.

Why This Matters

HSBC's decision may set a precedent for other financial institutions, potentially eroding trust among customers who rely on secure folders for privacy. The lack of communication and alternative access routes could push users toward less secure practices, such as installing the banking app in the main phone profile against their preference. Regulators may scrutinize whether this silent policy change violates consumer duty rules. For affected customers, the immediate consequence is a significant loss of control over their own accounts, with limited recourse.

When asked how it planned to notify customers, an HSBC UK spokesperson told The Register: "Customers who try to access our app with private space and virtual space tools are informed that to help protect their accounts, they will not be able to access the HSBC UK mobile banking app within private space and virtual space tools." Samsung and Google have not yet commented on the situation.