This question already has an answer here:
I took a look at google and here and I coudn't find the answer to this question:
Let's say that I have a Webservice and an Android app. They communicate over HTTPS. Should I encrypt traffic or I can assume that the communications are relatively secure?
I'm not considering cert pinning here. In this case, cert pinning use would change the security measures that I should put in place?
This scenario comes to my mind when considering that an attacker that controls the device running the app (that is fairly easy) can intercept the communication and see every bit of clear information being transmitted.
Scenario: I have a app that can make payments with credit card. Should I rely on TLS to secure the credit card information being sent?