Swiss Bankers
Bounty Range
$62 - $9,300
external program
Swiss Bankers
Swiss Bankers is an internationally oriented financial-services provider. Our company is a leader in development, distribution and processing of prepaid credit cards and offers innovative solutions in cashless and secure payment transactions. With our mobile app, our customers are able to order, load and manage their credit cards. They're also able to send and receive money globally within the MasterCard send network.
The goal of this program is to find vulnerabilities in our system that leads to unauthorised account takeover, anomalies during the "add funds" process and irregular "send" transactions.
Rules - UPDATED 09/01/2026
Swiss Bankers operate various services (platforms, services). But only services from explicitly listed domains / URLs are in the scope of the Bug Bounty Program. All other domains or explicitly listed services are therefore not eligible for reward and do not fall under the Legal Safe Harbor Agreement.
By participating in this Bug Bounty Program, Friendly Hackers undertake to document information about any vulnerability found exclusively via the platform's designated reporting form and not in any other places. They also agree to keep the found vulnerability secret after reporting it on the platform. Finally, they undertake to upload to the platform any data from customers that they have obtained as part of a bug bounty program and to delete any local copies afterwards and not to distribute them further.
Hacking Methods
In participating in the program, ethical hackers agree not to use methods that would adversely affect the tested applications or their users. These include:
In addition to the prohibited hacking methods listed above, Friendly Hackers are required to immediately discontinue vulnerability scanning if they determine that their conduct will result in a significant degradation (negative impact on regular users or on the operations team) of the Platform's or Service's operations.
Qualified vulnerabilities
Any design or implementation problem can be reported that is reproducible and affects security.
Typical examples:
Other examples:
Non-qualified vulnerabilities
The following vulnerabilities and forms of documentation are generally not wanted and will be rejected:
Not in scope: All (sub) domains and services that are not explicitly listed, are not in scope as e.g.
The identity verification (Intrum/IDNow) in the app is not in scope, however it's allowed to follow this process to setup an account in the app.
In scope:
The goal of this program is to find vulnerabilities in our system that leads to unauthorised account takeover, anomalies during the "add funds" process and irregular "send" transactions.
It is also allowed to order physical cards. A limit of 6 cards per customer is configured. If this limit can be bypassed, please do not order more than 8-9 cards.
See list of allowed URLs / targets. Please get in touch in advance if you think there should be another URL in scope to test the services.
Main
Mobile Apps
OpenTech Backend Services
OpenTech URLs and services needed for the Customer Portal and Mobile Apps:
Integration Hub
The organisation gives their approval for Friendly Hackers to use hacking methods based on the specified bug bounty program. Due to this consent, the criminal liability criterion of unauthorized obtaining/unauthorized use and thus the criminal liability of the Friendly Hackers with regard to the criminal offenses in Art. 143 Swiss Criminal Code (Unauthorised obtaining of data) and Art. 143bis Swiss Criminal Code (Unauthorised access to a data processing system) does not apply.
| Severity | Bounty |
|---|---|
| Critical | CHF 3000-7500 |
| High | CHF 1500-3000 |
| Medium | CHF 200-1000 |
| Low | CHF 50-200 |