Our (financial/banking) mobile app requires user to enter username/password in order to get data via webservice calls. Once user is logged in, credentials are stored in global variable until user logs out. If application is sent to background (text msg, phone call etc.) we would start a timer and log user out if app did not become active again after specified time interval.
One of our customers told us that this is not secure and is asking us to change this behavior and to log user out immediately if application goes into background. They did not want to disclose reason why they think our approach is insecure and we are wondering if what we are doing is really insecure and why, or if they are just overly paranoid.