CITT

    Scan results

    Ubank Money App

    Android

    Ubank is a digital banking app from NAB Group offering savings accounts, bill management, home loans, and integrated financial tools. Features include bonus interest rates, spending insights, shared accounts, and support for digital wallets. Requires age 16+, Australian/NZ residency.

    CITT SCORE
    68
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Everyday banking users comfortable with behavioral analytics

    Not For: Users who prefer banks not profile their tap patterns

    What It Means For You

    In-app behavior, including how users tap and navigate, is profiled by a behavioral analytics service running inside the app. Usage data is shared with marketing and engagement platforms, which may result in targeted notifications based on banking activity. How data is secured on the device falls below the standard expected for a financial app.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (15)

    Data Security

    4 total
    1 Critical
    1 High
    2 Medium

    Network Security

    1 total
    1 High

    Code Security

    3 total
    2 Medium
    1 Low

    Privacy

    5 total
    1 Critical
    1 High
    3 Medium

    Third-Party Risk

    1 total
    1 Medium

    Permission Usage

    1 total
    1 Low

    Third-Party Services

    BioCatch, MoEngage, Firebase, AppsFlyer, Tealium, Intercom, Akamai Bot Manager, PingIdentity, Google Analytics

    Security Strengths

    • ✓Hardware-backed encryption (Android Keystore + Identity Vault with AES-256-CBC)
    • ✓Multiple security SDKs (BioCatch, Akamai Bot Manager, PingIdentity MFA)
    • ✓Modern Android target (SDK 35) with security best practices
    • ✓Passkey/WebAuthn support for passwordless authentication
    • ✓Screenshot protection when backgrounded
    • ✓Proper debuggable flag disabled in production
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    biometric
    ads
    location

    Package

    au.com.bank86400

    Version

    11.257.1 (versionCode: 1125701)

    Analysis Date

    Feb 9, 2026

    Classes Analyzed

    200

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 4 findings (1 critical, 1 high, 2 medium)

    Network Security - 1 finding (1 high)

    Code Safety - 0 findings

    Privacy - 5 findings (1 critical, 1 high, 3 medium)

    Privacy Concerns

    What Data is Collected

    The app collects behavioral data about how users tap, scroll, and navigate through screens. Device identifiers, session usage patterns, and signals tied to user interactions are gathered to support analytics, fraud detection, and marketing services. Financial activity generated during user sessions may be captured and used for engagement and notification purposes.

    Third-Party Data Sharing

    Data is shared with the following third-party services:

    • BioCatch - Behavioral biometrics profiling based on user tap and navigation patterns
    • MoEngage - Mobile marketing and push notification targeting
    • Firebase - Usage analytics and crash reporting
    • AppsFlyer - Mobile attribution and marketing analytics
    • Tealium - Data collection and audience management
    • Intercom - Customer support and in-app messaging
    • Akamai Bot Manager - Bot detection and traffic management
    • PingIdentity - Identity and access management
    • Google Analytics - Usage analytics

    Understanding the Scores

    • Security Score: 72/100
    • Privacy Score: 65/100
    • Data Security: 60/100
    • Network Security: 88/100
    • Code Safety: 82/100
    • Data Collection: 70/100
    • Data Sharing: 75/100
    • User Control: 68/100

    Scores run from 0 to 100. Higher is better. Financial apps are held to a stricter standard than general consumer apps.

    Positive Security Features

    This version of the app did not include observable security strengths in its current configuration.

    Areas for Improvement

    • On-device data storage should be strengthened to better protect banking information if the device is accessed without authorization.
    • The ability to control what behavioral data is collected and shared with marketing platforms should be more visible and easier to exercise from within the app.
    • The number of third-party analytics and marketing services receiving user behavioral data is higher than expected for a financial application.

    About This Analysis

    This scorecard is based on automated static analysis of the app binary. Results reflect the app version analyzed and may not capture all server-side behavior or changes introduced in later updates.

    App Details

    FieldValue
    App NameUbank Money App
    Package IDau.com.bank86400
    Version11.257.1 (build 1125701)
    Scan Date2026-02-09

    Right of Reply

    Developer not yet contacted