.bank.in Supercookies: How India's Banking Domain Becomes a Cross-Bank Tracking Vector

A domain suffix designed to be a trust anchor — telling citizens "this website is genuinely your bank" — can accidentally become a cross-bank tracking surface when the browser doesn't know that sbi.bank.in and hdfc.bank.in should be treated as separate sites.

This page documents the browser cookie mechanics, the Public Suffix List fix that already exists, the gap that remains in practice, what Kingsly J discovered in Feb 2026, and an expedition plan to find real-world abuses.

1. The Public Suffix List & Cookie Isolation

The Public Suffix List (PSL) is a machine-readable catalogue that tells browsers which domain suffixes belong to a registry — so cookie.example.co.uk and other.example.co.uk can't read each other's cookies.

Without a PSL entry for bank.in, the browser treats it as a "private domain":

The mechanic is simple: any cookie set with Domain=.bank.in by one bank will be sent to every *.bank.in domain the user visits. This means:

• A session cookie set by SBI's site can be read by HDFC's site
• A tracking cookie (ad ID, analytics fingerprint) follows the user across every bank visit
• A malicious bank (or a compromised third-party script on any bank's page) can set cookies readable by all other banks

2. .bank.in on the PSL — Already Fixed at the Registry Level

During our research for this page, we discovered that bank.in is already on the Public Suffix List.

It was added via PR #2603 — "add bank.in and fin.in to the public suffix list" — submitted by Gaurav Kansal (NIC.IN), the .in registry operator, on 2025-11-06 and merged the same day by PSL maintainer Simon Friedberger.

This was part of the broader update by NIXI/NIC.IN to bring all official .in second-level domains onto the PSL — covering bank.in, fin.in, ac.in, gov.in, edu.in, and others added in the same batch (PR #1588, then PR #2603).

3. The Gap That Remains — PSL Updates Are Not Instant

Adding bank.in to the PSL repository is necessary but not sufficient. Here's why the risk persists:

3a. Browser Release Cycles

The PSL is shipped with browser releases. Chromium fetches updates every ~4-6 weeks for Chrome; Firefox ships with each release (~4 weeks). Safari and mobile WebViews update on their own cadence. A user running a 3-month-old browser in Feb 2026 would not have the Nov 2025 PSL update.

3b. Embedded Browsers & WebViews

Many Indian apps — banking apps, UPI apps, fintech — use embedded WebViews to render bank pages. These WebViews often use a bundled Chromium WebView that may not receive PSL updates for months or years. An SBI YONO app WebView from early 2025 would never know about bank.in on the PSL.

3c. Third-Party Tracking Scripts

The most dangerous vector: if any .bank.in site loads a third-party script (analytics, ad network, fraud detection, support widget), that script can set Domain=.bank.in cookies. Since browsers without the PSL update see bank.in as a single "site," the third-party can correlate user behaviour across SBI, HDFC, ICICI, and all other banks.

4. Kingsly's Discovery — Feb 27, 2026

Kingsly's finding is significant because:

• The cookies existed 3+ months after PSL entry — meaning either the user's browser hadn't picked up the PSL update, or the site was still setting cookies in a way that assumed no PSL protection
• Cookie naming suggests a tracker: _iidt and _vid_t follow the pattern of visitor ID / device ID cookies used by ad-tech and analytics platforms
• WZRK_S_... is particularly suspicious — this naming convention matches WizRocket (now part of CleverTap), a customer engagement and analytics platform widely used by Indian fintech companies

USER visits sbi.bank.in
    │
    ├─ SBI page loads
    │   └─ Third-party script (analytics/marketing) sets:
    │      Set-Cookie: _iidt=abc123; Domain=.bank.in
    │      Set-Cookie: _vid_t=xyz789; Domain=.bank.in
    │      Set-Cookie: WZRK_S_...=...; Domain=.bank.in
    │
    └─ Cookie stored for .bank.in

USER visits hdfc.bank.in (different bank, same browser)
    │
    └─ Browser sends ALL .bank.in cookies:
       Cookie: _iidt=abc123; _vid_t=xyz789; WZRK_S_...=...
       │
       └─ HDFC page can now read these cookies via JS
          └─ Third-party scripts on HDFC can correlate:
             "Same visitor who was on sbi.bank.in"

5. Theoretical Privacy Harms

If a tracker successfully sets a .bank.in-scoped cookie, the following cross-bank profiling becomes possible:

6. Trackers Observed on .bank.in Sites

Live scan of 13 domains revealed the following third-party tracking services actively running on .bank-in websites:

Key observation: Every single cookie from these trackers is scoped to the bank-specific subdomain (e.g. .axis.bank.in, .icici.bank.in), not the bare .bank.in. This confirms the PSL entry is doing its job on modern browsers.

7. 🕵️ Expedition Findings — Live Scan Results (June 30, 2026)

We ran a systematic scan across 13 major bank domains using agent-browser (Chrome-based headless browser):

What about Kingsly's findings?

Kingsly found _iidt, _vid_t, and WZRK_S_... cookies scoped to .bank.in in Feb 2026 — 3 months after the PSL entry. Possible explanations:

1. Browser lag: Chrome/Edge/Firefox hadn't shipped the PSL update yet. PSL updates take 4-6 weeks to reach stable browser releases, and users on older versions may never receive them.
2. Mobile WebView: Banking apps using embedded WebViews with ancient Chromium versions that don't receive PSL updates at all.
3. The cookie was already scoped to the subdomain and Kingsly's observation was about what could happen, not the actual Domain attribute.

Key Insight: The tracker density is high but isolated

Every major bank has at least one marketing/analytics tracker on their .bank.in page. While cross-bank supercookies aren't currently active on desktop because of the PSL, the tracker ecosystem is primed for abuse if the PSL entry were missing or bypassed:

• CleverTap/WizRocket (WZRK_* cookies) — used by Axis Bank. Loads from d2r1yp2w7bby2u.cloudfront.net. If CleverTap is also embedded on other .bank.in sites, the same visitor ID could be correlated.
• Adobe Audience Manager — used by Axis, ICICI, Kotak. Uses demdex.net third-party cookies for cross-site audience profiling. While these are not .bank.in-scoped, they can link banking behaviour across sites in Adobe's ecosystem.
• VWO (Visual Website Optimizer) — used by ICICI, IDFC First. A/B testing with visitor-level cookies.
• Facebook Pixel (_fbp) — used by Kotak, Federal, IndusInd, Bandhan. Links banking behaviour to Facebook user profiles for ad targeting.

Expedition Methodology

1. Open each *.bank.in domain in headless Chrome (agent-browser)
2. Wait for full page load (CSS/JS execution complete)
3. Dump all cookies with full metadata (domain, path, secure, httpOnly, sameSite)
4. Identify any cookie with Domain=.bank.in (not bank-specific subdomain)
5. Enumerate third-party scripts loaded from tracking/analytics domains

The automated scanner script has been saved to the repository at scripts/scan_bankin_cookies.py for regular re-runs.