HSBC Android banking app fails with Heliboard

[johnnytheripper]

Any ideas to resolve please feel free to suggest.
https://play.google.com/store/apps/details?id=au.com.hsbc.hsbcaustralia

[Helium314]

I think there is a similar issue for another banking app. Maybe you could also ask to point at what exactly makes them think HeliBoard is a security risk.

[johnnytheripper]

Reported to publicly listed Android contact emails ***@***.*** & ***@***.*** - no reply yet. I think it's a security risk coz they cant log keystrokes.

…

On 1/04/2026 4:55 pm, Helium314 wrote: I think there is a similar issue for another banking app. Maybe you could also ask to point at what exactly makes them think HeliBoard is a security risk. — Reply to this email directly, view it on GitHub <#2422?email_source=notifications&email_token=CA74MOMTQIGY4VMIVCLCXX34TUNVVA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCNRUGA4TKNRVUZZGKYLTN5XKMYLVORUG64VFMV3GK3TUVRTG633UMVZF6Y3MNFRWW#discussioncomment-16409565>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/CA74MOOBSGXAXSBYBM3TT3T4TUNVVAVCNFSM6AAAAACXIFW7LKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTMNBQHE2TMNI>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[seabaughiiijohn87-gif]

• • • - - - - - - ``````
• > >

![board-background.png](https://github.com/user-attachments/assets/a336ea80-23a4-489f-8460-3f60ef37eb94)

[johnnytheripper]

Please supply a resoonse for the following on behalf of HSBC. Why is the HSBC Australia Android banking app treating the Heliboard privacy focussed keyboard as a security risk? You – 11:10 PM Kindly be advised HSBC may restrict the mobile app usage if you are using untrusted keyboard for security purposes. From a security and fraud-prevention standpoint, using a third party app for the keyboard is a high‑risk, especially for passwords, PINs, one-time passcodes (OTPs), and Digital Security Key activation codes. 11:17 PM Yan – 11:17 PM

…

On 1/04/2026 4:55 pm, Helium314 wrote: I think there is a similar issue for another banking app. Maybe you could also ask to point at what exactly makes them think HeliBoard is a security risk. — Reply to this email directly, view it on GitHub <#2422?email_source=notifications&email_token=CA74MOMTQIGY4VMIVCLCXX34TUNVVA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCNRUGA4TKNRVUZZGKYLTN5XKMYLVORUG64VFMV3GK3TUVRTG633UMVZF6Y3MNFRWW#discussioncomment-16409565>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/CA74MOOBSGXAXSBYBM3TT3T4TUNVVAVCNFSM6AAAAACXIFW7LKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTMNBQHE2TMNI>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[Helium314]

Oh great, a useless generic answer

[Helium314]

I found the other issue I mentioned, could you try the debug version with disabled accessibility settings linked in #2412 (comment)?

[johnnytheripper]

I tried 3.9-debug but the same problem again unfortunately. I took a bug report if there's anything in there you may need to see.

…

On 2/04/2026 9:15 pm, Helium314 wrote: I found the other issue I mentioned, could you try the debug version with disabled accessibility settings linked in #2412 (comment) <#2412 (comment)>? — Reply to this email directly, view it on GitHub <#2422?email_source=notifications&email_token=CA74MOIWS5EK7K7I6INTO5L4T2U3ZA5CNFSNUABIM5UWIORPF5TWS5BNNB2WEL2ENFZWG5LTONUW63SDN5WW2ZLOOQXTCNRUGI3TCNJTUZZGKYLTN5XKMYLVORUG64VFMV3GK3TUVRTG633UMVZF6Y3MNFRWW#discussioncomment-16427153>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/CA74MON2YQJ5YNHZCUCXJF34T2U3ZAVCNFSM6AAAAACXIFW7LKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTMNBSG4YTKMY>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[nugraha-abd]

FUTO Keyboard also suffers from the same issue. But it's a 11 months old video tho, might have been fixed
https://www.youtube.com/watch?v=XeQcIbv-eqo

[johnnytheripper]

HSBC have been notified about Heliboard being wrongly flagged as spyware in the form of a notice of complaint. No response was provided to technical details requested from technical support staff ie. why it thinks it's spyware.

…

On 14/04/2026 3:51 pm, nugraha-abd wrote: FUTO Keyboard also suffers from the same issue. But it's a 11 months old video tho, might have been fixed https://www.youtube.com/watch?v=XeQcIbv-eqo — Reply to this email directly, view it on GitHub <#2422 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/CA74MOOSG3ZSNFWVZPXHM7T4VYX5PAVCNFSM6AAAAACXIFW7LKVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTMNJVGY4DOOI>. You are receiving this because you authored the thread.Message ID: ***@***.***>

[Helium314]

related issue: #2516

[huw0]

I experienced this issue with first direct (a subsidiary of HSBC UK) starting around the 17th July. The problem appears to have resolved following an app update on the 13th August.

I had raised an official complaint - and received a boilerplate response around 'security'. Also directly e-mailed the global and UK CISOs.