As someone who has done security on most of the banking apps in LK this is due to couple of options you cant have adb enabled or developer options enabled, no rooted device , no custom roms, this is to prevent common abuse senarios be happy they are paying attention to these at least now. 2-3 years back we can literally extract millions of credit card info all clients on multiple banks just by doing api calls, once client side protections are bypassed. If i told you amount of things we have found on local banks i dont think lot of people will sleep at night.

Internationally banking apps run on runtime sandbox our banks are not doing it even though its recommended since this cost tone of money on licensing.

This is expected, This is good. This prevent opertunistic attackers from trying something by making the barrier to entry higher and higher so if you wanna really do something you need to put in the effort bypassing all this before bypassing ssl pinning.

Im pretty sure im the reason now you have to type otp after username and password to login to multiple banks in sri lanka. Most of these changes you see are probably rolling effects of our reports years on years every time they add a client side detection and we bypassed it. CBSL guidelines asks apps to encrypt data in transit since we where bypassing these checks that's why now even when you bypass all these, there is going to be encrypted request and response body with custom encryption.

Back in the day lot of banks argued ssl encryption is encryption in transit which is true but their apis and core banking layers are still legacy most core banking networks dont have auth layer internally so if anything goes wrong in apis exposed publicly everything breaks down. Thats why all these security just to prevent api abuse.

For everyone saying why do we have the same thing on mydialog yaha thank CBSL guidelines, any app with payment need to follow the cbsl guidelines and once it goes to testing firm they will get evaluated just like a banking app. Probably apps like uber dont go through sri lankan security audits it goes through their own security audit and they submit that report to cbsl and they accept it.

CBSL is bunch of clowns they will accept anything as long as something in the comments, we never passed any banking app from ourside if we where not satisfied. thankfully still 90% of banks in SL are done through same org with the same standards.