The idea is that, if a person has a rooted phone, it might have been rooted by someone other than the owner, in which case it's compromised. Also a rooted phone

The idea is that, if a person has a rooted phone, it might have been rooted by someone other than the owner, in which case it's compromised. Also a rooted phone in the hands of an unsophisticated, trusting user is easier to attack and compromise than one not rooted. For a banking establishment with many interconnected devices, these are reasonable concerns. To see how an apparently trivial peripheral vulnerability can bring down an entire network, look at how Target was successfully attacked, step by step, from the outside in: http://www.aorato.com/blog/untold-story-target-attack-step-step/ http://www.aorato.com/blog/untold-story-target-attack-step-s... Don't get me wrong. All my Android devices are rooted, but I can see the logic behind the policy.