Review Finds Data Tracking on 9 of 14 Banking Sites

A review of 14 financial-services websites in Europe and the United States found tracking scripts sending customer information to third parties. On 9 of the 14 sites, this happened without a valid consent choice, according to the review, published by TechRadar and attributed to Jscrambler’s Head of Security Research.

The review says scripts in account-opening, mortgage and loan-application flows transmitted contact details, financial intent and device fingerprints. In one personal-credit application, a loan amount of €2,500, a 12-month term and an insurance selection reached Google Analytics regardless of consent status. At a Portuguese bank, a customer’s name, age and tax number were sent to Evergage as Base64-encoded text in a request URL.

At a Dutch banking site, a first-party script combined browser fingerprinting with requests to 127.0.0.1 on ports 7070 and 5938, which the source associates with AnyDesk and TeamViewer. The review says this checked whether remote-access software was running on a visitor’s device.

Meta and TikTok have previously said website operators control what data is collected. The article notes that Meta Pixel’s Automatic Advanced Matching is enabled by default and can capture and hash contact-form data, complicating that responsibility.

The author says the findings raise compliance questions under rules including the EU’s GDPR, ePrivacy requirements and DORA, as well as US federal and state privacy rules. The article recommends checking script behavior on sensitive pages and ensuring rejected consent stops data transfers. It says banks can continue using analytics and personalization while treating scripts on sensitive pages as part of their risk surface.