Citi Mobile® Security & Privacy Scorecard

Citi Mobile®

Developer: Citi
Version: 9.90.0
Platform: Android
Scan Date: February 5, 2026

What This Means for You

In-app activity is shared with analytics and marketing services including Adobe and Firebase. A session-replay service records how users navigate their account screens. Multiple behavioral monitoring services also track device patterns, and financial data flows through third-party aggregation services linked to the account.

Recommendation: Trustworthy

Best For: Citi customers comfortable with behavioral monitoring

Key Findings

Data Security - 2 findings (1 medium, 1 low)

Network Security - 1 finding (1 low)

Code Safety - 0 findings

Privacy - 6 findings (1 high, 4 medium, 1 low)

Privacy Concerns

What Data is Collected

The app collects behavioral signals, device identifiers, and detailed navigation patterns from account sessions. Biometric and behavioral data is gathered continuously by fraud detection services embedded in the app. Financial account data is also shared with third-party aggregation services connected to the account.

Third-Party Data Sharing

Data is shared with multiple third-party services across several categories:

• Analytics and Marketing: Adobe Marketing Cloud, Firebase Analytics
• Behavioral Fraud Detection: BioCatch, LexisNexis ThreatMetrix, Cyberfend, Payfone
• Session Recording: Glassbox
• Financial Data Aggregation: Yodlee, Plaid
• Security and Identity Verification: APIGuard (Approov), Mitek, Dyadic Security MPC
• Payments: Ondot Systems, Samsung Pay, Zelle

Understanding the Scores

Positive Security Features

• Strong network-layer protections keep financial data encrypted during transmission, reflected in a 95/100 Network Security score.
• Solid internal data handling practices help protect sensitive account information within the app itself.

Areas for Improvement

• Data is shared with a large number of third-party services, including session-recording and behavioral profiling companies, with limited transparency into how that data is used beyond the Citi relationship.
• The Data Sharing score of 55/100 reflects that user information flows to numerous external parties beyond what is needed for core banking functions.
• Users have limited ability to opt out of the behavioral monitoring and analytics services embedded within the app, as reflected in a User Control score of 60/100.

About This Analysis

This scorecard is based on static code and configuration analysis of the app at the version listed below. It covers the app's structure, data practices, and third-party integrations as observed at the time of the scan.

App Details