Unicredit banking app set-up issue

F0RCE

Hello,

I'm trying to reinstall my banking app (Unicredit Mobile Banking) after upgrading from a pixe 6a to a pixel9.
The registration process implies getting an OTP SMS when setting up the app.
The issue is that the app does not 'see' the received SMS, it is still counting down, waiting for it to arrive.
Saddly there is no way to manually input the data from the received sms.

The sms looks like this, I changed the numbers: <#> Cod de activare Mobile Banking. NU-L DISTRIBUI! Acceseaza muciro://1234567890123456 Detalii la numarul *2020. GpId2tZTy7a

Sometimes I also get a crash, error here: https://pastebin.com/1Hif7eda

I did activate in the app's setting "Exploit protection compatibility mode" but no change sadly.

Anyway to resolve this? This will be a showstopper for me if I cannot fix it. I cannot even use the web interface as the app is the one generating the login token 🙁

Novalissoide

F0RCE Unicredit Mobile Banking

https://github.com/PrivSec-dev/banking-apps-compat-report/issues/87
It is reported as 'Works as intented'.

mmobder

F0RCE the latest GOS update mentions "fix an issue in our infrastructure for spoofing permission self-checks breaking automatically reading SMS one-time codes for certain apps", should arrive soon, dunno if relevant. FYI

mmobder

Dumb question, but still, have you granted sms access to the app?

F0RCE

mmobder

No such thing as a dumb question :D

I have allowed the "Phone" permission, I don't see a dedicated SMS permission in the lists: for the banking app https://pasteboard.co/VpBiCfuXq9ur.png

somerandomdude

Yep, google play service has access to SMS: https://pasteboard.co/T0vYYqyVT3gM.png
I've also tried to change the auto fill provider to google but still no dice.

Sadly this is a showstopper for me if it cannot be fixed/addressed by GOS, even tough I understand that this is not the OS's fault.

At the end of the day I just need to be able to do my banking and I even need the mobile app to generate the OTP for the website version of the bank.

I will see if someone has any more ideas for me to try the next 2 days and if not I will be forced to revert to the stock OS :(

somerandomdude

Doing a bit of digging and research, this might not be an isolated case. There's another post in the forum detailing all the steps users took to go through on another app, but to no avail.
https://discuss.grapheneos.org/d/29522-banking-app-login-problems

Giving Google Play Services SMS permissions, setting Google as the main auto-fill provider, tweaking inner Google settings (auto-fill codes in apps and sites) did nothing to solve the issue.

I can also bring up BTPay as having a similar issue due to not allowing users to manually type in the SMS OTP code. They expect it to be filled in by Play Services.

I don't think there's much we can do, but pressure banks to reverse such ridiculous security theatre.

Novalissoide

F0RCE you should reverse changes done in the Developer Options, then turn them off. Have Adb been used at any time, for any reason?

F0RCE

I did have developer option enabled but don't remember changing anything. I have since, at the recommendation of someone from GOS discord, disabled developer options and retired the process, still the SMS is not "auto-filled" :(

If there is a list of default settings for developer options I can re-enable and check against that just to be sure I did not change anything.
I have not used ADB ( guess that was for connecting the phone to the PC, right?)

Thanks for the help!

F0RCE

@Novalissoide

Indeed it did work as intended on my pixel 6a before, because the set-up was already made when it was possible to add the received OTP manually.

Now that I have upgraded pixel 9, and had to reinstall the app there is no input field anymore. I went to the bank today and the customer rep did confirm that there is no input field anymore in the app.

Novalissoide

F0RCE is this the one?

https://play.google.com/store/apps/details?id=hr.asseco.android.jimba.mUCI.ro

Novalissoide

F0RCE no input field anymore

If you could find a previous version from pre-removal of that feature, just to get it up and then update it?

F0RCE

Novalissoide Yes

Novalissoide

F0RCE
I can't deeply test the functionality, but will look for obvious clues.

This got some steps to try if you haven't already:
https://discuss.grapheneos.org/d/8330-app-compatibility-with-grapheneos

And here is a small (WIP) collection, mostly from this support forum of things that may or may not disrupt functionality of some banking apps;

Location not enabled, or fake location detected
Developer options enabled
Adb used
Shizuku or rooting detected
Having a private space
More than one profile running
App installed in secondary user
App not installed from Play Store

Using a less common keyboard app
Screen sharing detected
Having no sim
System time out of sync
Very short system uptime
Vpn detected
Proxy usage
Private DNS enabled

GrapheneOS:
GrapheneOS not updated
Sandboxed Google Play Services not installed
Sandboxed Google Play Services not allowed running unrestricted
Sandboxed Google Play Services not allowed phone permission
Sandboxed Google Play Services not allowed network permission
Automatic exploit protection compatibility mode turned off

Novalissoide

F0RCE Take a look at this setting;

Settings > Apps > Sandboxed Google Play > Google settings > All Services > Verification codes by SMS

F0RCE

Novalissoide

From the above big list I did not find anything that would not be set as expected.

Also, verification codes by SMS is allowed:

https://pasteboard.co/OADWBqBqce8O.png

Novalissoide

F0RCE try a different messages app, say;
https://github.com/FossifyOrg/Messages/releases

F0RCE

Novalissoide

No auto-fill with Fossy Message either.

I don't know here I can get an older version of the app.

Thank you for help, guess I will be reverting to the stock OS.

mackoursus

Last week i gave up on GrapheneOS because of the UniCredit Bank(Slovakia) app. I was able to run it and recieve
the authorization sms from bank system. App worked ok, made some test money transfers BUT i was not able to
pay from the app. It requires confirmation token between payment gateway and the bank. It didnt arrive at all, tried it several times. Same problem with Prima Banka Slovakia. Maybe im doing something wrong, could be, im not that tech savvy. I will use it as a secondary/burning device till i will found out what to do next.

tux_

The way things seem to be going in Europe, soon two devices will be needed. One cheap, non-rooted, Googled phone at home for official purposes, powered off when not in use, and a second everyday phone running GrapheneOS for everything else. The cheap phone essentially serves as a glorified hardware token in this setup and presumably does not even need a SIM after setup.

F0RCE

I just installed the latest release (https://grapheneos.org/releases#2026011000) and the SMS is still not being auto-filled,

Thank you to everyone who tried to help.

Novalissoide

F0RCE Got it. We'll see if the other ones get any breakthrough with this update.