The rapid digitalization of Pakistan's banking sector has increased the importance of securing mobile banking applications that process sensitive financial information. Although numerous studies have evaluated the security of mobile banking applications in various countries, comprehensive empirical assessments of Pakistani mobile banking applications remain limited. This study presents a systematic security assessment methodology for Android-based mobile banking applications in Pakistan. The methodology was applied to 11 applications from State Bank of Pakistan–licensed commercial banks, selected using objective criteria of at least 500,000 downloads and a minimum user rating of 3.0 from an initial population of 27 licensed institutions. Automated static analysis was performed using the Mobile Security Framework (MobSF) version 4.5.0, and all high-severity findings were manually verified through JADX source code inspection to reduce false positives. Confirmed vulnerabilities were classified according to the OWASP Mobile Top 10, and application security was comparatively evaluated using a weighted Security Coefficient adapted from Bucko (2017). The results revealed a mean security score of 51.09 out of 100, with no application exceeding a score of 60. The most prevalent confirmed weaknesses were M3: Insecure Communication and M5: Insufficient Cryptography, each affecting 54.5% of the analyzed applications. The findings provide the first comprehensive empirical benchmark of the security posture of major Pakistani Android mobile banking applications and offer practical recommendations for financial institutions, developers, and the State Bank of Pakistan to strengthen mobile banking security
Syed Abdul Ahad (Fri,) studied this question.