'%3e%3cpath%20d='M138%2095.6436V147H0V0H138V51.3564H59.3526V95.6436H138Z'%20fill='white'/%3e%3cpath%20d='M208%200V147H150V0H208Z'%20fill='white'/%3e%3cpath%20d='M361%200V51.4292H321.377V147H261.731V51.4292H220V0H361Z'%20fill='white'/%3e%3cpath%20d='M512%200V51.4292H472.939V147H414.139V51.4292H373V0H512Z'%20fill='white'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_1_12'%3e%3crect%20width='512'%20height='147'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
Scan results
Citi Mobile®
AndroidCiti Mobile is a comprehensive banking app offering account management, mobile check deposit, bill payment, Zelle transfers, spending insights, and FICO score access. Features include SmartAccess aggregation, fraud protection with Quick Lock, and support for 60,000+ fee-free ATMs.
Quick Verdict
Best for: Citi customers comfortable with behavioral monitoring
What It Means For You
In-app activity is shared with analytics and marketing services including Adobe and Firebase. A session-replay service records how users navigate their account screens. Multiple behavioral monitoring services also track device patterns, and financial data flows through third-party aggregation services linked to the account.
Quick Verdict
Best for: Citi customers comfortable with behavioral monitoring
What It Means For You
In-app activity is shared with analytics and marketing services including Adobe and Firebase. A session-replay service records how users navigate their account screens. Multiple behavioral monitoring services also track device patterns, and financial data flows through third-party aggregation services linked to the account.
Method and Limitations
Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.
Findings (13)
Data Security
2 totalNetwork Security
1 totalCode Security
4 totalPrivacy
6 totalThird-Party Services
Security Strengths
- ✓AES256-GCM encrypted storage with hardware-backed Android Keystore
- ✓APIGuard certificate pinning on all Citi domains
- ✓BioCatch behavioral biometrics for fraud detection
- ✓7-layer security SDK stack (BioCatch, APIGuard, LexisNexis, Cyberfend, Payfone, Ondot, Dyadic)
- ✓Build hardening (debuggable=false, allowBackup=false, 62% code obfuscation)
Version diff is on the Developer plan. See developer plans.
Context Tags
Package
com.citi.citimobile
Version
9.90.0
Analysis Date
Feb 5, 2026
Classes Analyzed
47,382
Was this analysis helpful?
Feedback helps us improve our analysis
Recommendation: Trustworthy
Key Findings
Data Security - 2 findings (1 medium, 1 low)
Network Security - 1 finding (1 low)
Code Safety - 0 findings
Privacy - 6 findings (1 high, 4 medium, 1 low)
Privacy Concerns
What Data is Collected
The app collects behavioral signals, device identifiers, and detailed navigation patterns from account sessions. Biometric and behavioral data is gathered continuously by fraud detection services embedded in the app. Financial account data is also shared with third-party aggregation services connected to the account.
Third-Party Data Sharing
Data is shared with multiple third-party services across several categories:
- Analytics and Marketing: Adobe Marketing Cloud, Firebase Analytics
- Behavioral Fraud Detection: BioCatch, LexisNexis ThreatMetrix, Cyberfend, Payfone
- Session Recording: Glassbox
- Financial Data Aggregation: Yodlee, Plaid
- Security and Identity Verification: APIGuard (Approov), Mitek, Dyadic Security MPC
- Payments: Ondot Systems, Samsung Pay, Zelle
Understanding the Scores
| Category | Score |
|---|---|
| Security | 82/100 |
| Privacy | 68/100 |
| Data Security | 88/100 |
| Network Security | 95/100 |
| Code Safety | 85/100 |
| Data Collection | 65/100 |
| Data Sharing | 55/100 |
| User Control | 60/100 |
Positive Security Features
- Strong network-layer protections keep financial data encrypted during transmission, reflected in a 95/100 Network Security score.
- Solid internal data handling practices help protect sensitive account information within the app itself.
Areas for Improvement
- Data is shared with a large number of third-party services, including session-recording and behavioral profiling companies, with limited transparency into how that data is used beyond the Citi relationship.
- The Data Sharing score of 55/100 reflects that user information flows to numerous external parties beyond what is needed for core banking functions.
- Users have limited ability to opt out of the behavioral monitoring and analytics services embedded within the app, as reflected in a User Control score of 60/100.
About This Analysis
This scorecard is based on static code and configuration analysis of the app at the version listed below. It covers the app's structure, data practices, and third-party integrations as observed at the time of the scan.
App Details
| Field | Value |
|---|---|
| App Name | Citi Mobile® |
| Package ID | com.citi.citimobile |
| Version | 9.90.0 |
| Scan Date | February 5, 2026 |
Right of Reply
Developer not yet contacted