[ONE Android Development] Timmmmaaahh!:
Hello [MENTION=4065086]ironfreak[/MENTION]!

Oh my, financial transaction compromise, sounds pretty scary, we better get deeper into this right away!

Let's do a good old fashioned Risk Assessment! Because science rules.

There are three factors to take into account when performing a good RA: Probability, Exposure and Severity.

Probability

Scale: 1 = Unlikely, 2 = Unusual, 3 = Probable, 4 = To be expected

The chance that your bank account is compromised is highly unlikely because when rooted, a SU manager is the gatekeeper to lower level system access. In most cases today, this will be Magisk Manager. If you grant root access to an application you don't understand obtained from a dodgy source, there would be real danger involved. But I assume you're a sensible person that only allows reputable applications to gain system access so we'll assess probability as 1.

Exposure

Scale: 0.5 = Very uncommon, 1 = Uncommon, 2 = Once in a while, 3 = Occasionally, 6 = Regularly, 10 = All the time

This is a tough cookie. How much exposure of unauthorized access to your bank account is there? This is rather subjective as I would probably score this 0.5 as we've already established that there is very low probability for any dangers but you may believe – as banks tend to scare you into thinking rooting is the worst thing possible – it should be rated 10. Again, we'll agree that we are sensible beings that only download apps within the safe Play Store environment and perhaps a few apps that may need system access like MiXplorer, AdAway or iYTBP on the side. Now, even safe resources may contain malicious apps but it's very hard to quantify that. Time to do some research, I say! Two months ago this article stated that 22 malicious flashlight and utility apps were found on the Play Store. This one talks about 60 malicious apps being pulled from the Play Store last month. None of all these apps are aimed for your bank account, though. Let's dig a bit more specifically. BankBot! Now there's an interesting piece of malware. This article from last November details an interesting statistic on that: "The Google Play Store is unintentionally distributing a particular form of Android banking malware for the third time this year.". Aha! We have a number. Three times a year there's possible exposure, shall we use this as an objective measurement? Cool. That can't be called occasionally but it's not that uncommon either so let's assess exposure as 2.

Severity

Scale: 1 = Limited, 3 = Important, 7 = Severe, 15 = Very severe, 40 = Catastrophic

Let's say your system does get infected and your banking app is compromised, how severe would that be? Also not that easy to boil down to a number. What could be classified as limited to one person could be experienced as catastrophic to another. I'm using an industrial standard here that is actually designed to assess safety risks at work. In that prospect, 3 means an injury with work absence, 7 means indefinite work absence, 15 means one dead. Let's agree that nobody will die when your bank account gets compromised so we're in doubt between 3 and 7. Depending on bank insurances, you may be able to retrieve the stolen amount, which would leave us at 3 but if there's no way to get the money back we'd have to assess this as a 7. Let's put a pin in that.

Final score evaluation is accomplished by multiplying the established three numbers. As we're in doubt on that last one, we have two possible outcomes:

1 X 2 X 3 = 6

1 X 2 X 7 = 14

Both outcomes reflect a risk factor of 1 (≤20 = 1, 21-70 = 2, 71-200 = 3, ≥201 = 4)

That's good news, my friend! Risk factor 1 is a negligible risk so you can safely root your device and continue making financial transactions without worrying about crooks running off with your well earned pennies. Of course, you must always stay vigilant! Remember that we talked about common sense? Don't download any warez or dodgy APK's and certainly don't allow root access to any of those!

The method used above is according to the SEP Risk Assessment Model, an industry standard designed for quick RA. In other words: I did not make this up ^_^

You don't need to root your device in order to flash a ROM, by the way.

It should also be noted that the malware mentioned in this post works just the same without any root so the risk is identical to not rooting your device. Phishing always relies on the gullibility of its victim. Here's some guidelines from US-CERT on how you can prevent becoming a victim:

Use antivirus software

Be cautious about opening web files

Verify download authenticity

Configure web browsers securely

Back up personal data

Use strong passwords

Update operating and application software

Find the most up-to-date independent list of the best antivirus software for Android on AV-Test.org.

The real danger in rooting is berserking applications (or users, eg. you! lol) messing with your system files and destroying your device. But that's not really our concern, is it? Wipe /system + /data + caches, flash and we're good to go again.

For reference, my personal banking app does not mind root (doesn't even show a notice) and it's in the top 30 of largest banks in the world.

Whew! I got a bit carried away replying to that. I hope this has been a satisfying answer to your coincern (see what I did there?) and a helpful post to other users. Feel free to hit the thanks button below to show your appreciation :)