Banco de Costa Rica app Strong/Device integrity failing since 2026060100

jvbCR

Please excuse me if this is the wrong place to post this. I've been using the Banco de Costa Rica (BCR) banking app successfully for a long time with no issues. About 1-2 weeks ago it started showing this error on launch:

"Por su seguridad, esta aplicación no puede ser utilizada en este dispositivo." ("For your security, this application cannot be used on this device.")

The app itself hasn't updated since May 22, and was working fine after that update right up until the error started. The timing lines up with the 2026060100 release (full 2026-06-01 security patch level), which is the most recent OS update on my device.

I ran YASNAC (Play Integrity API Checker) and confirmed:

MEETS_BASIC_INTEGRITY: pass
MEETS_DEVICE_INTEGRITY: fail
MEETS_STRONG_INTEGRITY: fail

Device: Pixel 6 Pro
Channel: Stable, with "Receive security preview releases" toggled on
Security patch level shown: 2026-06-01

I noticed the 2026060100 changelog mentions a bionic fix for "incorrect anti-tampering code shared across many banking apps" reading /proc/self/maps — wondering if this (or something else in that release) could be related to BCR's app failing its own device check now, even though nothing on the BCR app side changed.

Has anyone else seen integrity verdicts flip from passing to failing after this update, or is this more likely something BCR's app is doing on their end (e.g., reacting badly to a legitimate OS-side change)? Happy to provide more logs/details if useful.

Thanks for any insight.

MyIdentityIsntImportant

jvbCR GrapheneOS (GOS) has never & will most likely never pass MEETS_DEVICE_INTEGRITY or MEETS_STRONG_INTEGRITY. The only thing GOS can pass is MEETS_BASIC_INTEGRITY. This hasn't changed in any recent update.

Whether the issue you're facing is due to the update changes you mentioned, that I can't answer due to a lack of knowledge. Though I can say that it's not the only possibility, since the bank could have just started requesting MEETS_DEVICE_INTEGRITY or MEETS_STRONG_INTEGRITY out of the blue. It's trivial to program in a Play Integrity check that requests a certain response based on a server side boolean, for example; no need to update the app for that separately if the capability is already in there. Not that I can say that's the reason either, since I don't have access to the code of your bank's app.

Sadly there's not any "solutions" I can offer, but maybe this cleared things up a bit. Good luck.

GrapheneOS

jvbCR Device and strong integrity check for a Google certified device/OS and have never passed for GrapheneOS. GrapheneOS will show a notification if an app uses the Play Integrity API, so you shouldn't assume it has anything to do with that if it doesn't show it unless you disabled the notification for the app which you can enable again if you did. You should update to the latest 2026061600 release in case the new workaround for the pairip anti-tampering change in 2026060600 is needed for this app.

GrapheneOS

Marking as solved because 2026061600 likely resolved it already but you weren't updated yet.