The Commercial Bank of Ethiopia has released a mandatory update to its mobile banking app, version 4.2.1, that merges login credentials across Android and iOS into a single “CBE Digital Password.” Security specialists warn this is a step backward. Consolidating access into one shared secret creates a single point of failure: if that credential is exposed, every enrolled device is exposed with it.
The rollout has also been unstable. Users report crashes during password setup, unexpected charges, broken biometric login, and a self-service reset feature that does not work. With no reliable recovery path, locked-out customers are being told to visit a branch, a process that reportedly takes days.
Experts say credential unification should have been optional, not forced, and never deployed without a working reset flow. CBE had not responded to requests for comment at publication.
