CITT

    Scan results

    Citizens Bank Mobile Banking

    Android

    Citizens Bank Mobile Banking app enables account management, check deposits, money transfers via Zelle, and bill payments with FDIC protection. Features debit card controls, same-day deposit credits, and account activity monitoring from your mobile device.

    CITT SCORE
    60
    out of 100
    TRUSTish

    Quick Verdict

    Best for: Citizens Bank customers comfortable with behavioral

    What It Means For You

    In-app behavior, navigation patterns, and session activity are recorded by Glassbox Digital and shared with Adobe Analytics and Firebase. Device identity is fingerprinted by ThreatMetrix for fraud detection, which involves profiling device details. Financial actions like Zelle transfers involve additional third-party processors who receive transaction data.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (10)

    Data Security

    3 total
    1 High
    2 Medium

    Network Security

    1 total
    1 Info

    Code Security

    4 total
    2 Critical
    1 High
    1 Low

    Privacy

    1 total
    1 Critical

    Permission Usage

    1 total
    1 Low

    Third-Party Services

    Glassbox Digital, Adobe Analytics, Firebase Analytics, Ensighten, Branch.io, Qualtrics, ThreatMetrix, Akamai Bot Manager, Transmit Security, Arkose Labs, Fiserv (Zelle), Mastercard Open Banking, Atomic Transact, Personetics, Pinwheel, MiSnap (Mitek)

    Security Strengths

    • ✓AES-256-GCM encryption for all sensitive data at rest
    • ✓Strict HTTPS enforcement with cleartext traffic blocked
    • ✓Heavy R8/Proguard code obfuscation
    • ✓Modern network stack (OkHttp, Retrofit, Apollo)
    • ✓FIDO2 biometric authentication implemented
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    biometric
    session recording
    analytics
    third party sdks

    Package

    com.citizensbank.androidapp

    Version

    25.24.0

    Analysis Date

    Jan 20, 2026

    Classes Analyzed

    60,416

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 3 findings (1 high, 2 medium)

    Network Security - 1 finding (1 info)

    Code Safety - 0 findings

    Privacy - 1 finding (1 critical)

    Privacy Concerns

    What Data is Collected

    The app collects in-app behavioral data including navigation patterns, session activity, and interactions within the app. Device characteristics are gathered to build a device profile used for fraud detection. Transaction details are processed and shared with financial service partners depending on the features used.

    Third-Party Data Sharing

    Data is shared with the following third parties:

    • Glassbox Digital - Records in-app behavior and session activity
    • Adobe Analytics - Receives usage and behavioral data
    • Firebase Analytics - Receives app usage events and activity data
    • Ensighten - Manages data distribution to third-party services
    • Branch.io - Receives attribution and marketing measurement data
    • Qualtrics - Receives survey responses and feedback
    • ThreatMetrix - Receives device details for fraud detection profiling
    • Akamai Bot Manager - Analyzes traffic patterns for security purposes
    • Transmit Security - Processes identity and authentication signals
    • Arkose Labs - Analyzes interaction patterns for fraud prevention
    • Fiserv (Zelle) - Processes payment transaction data
    • Mastercard Open Banking - Receives financial account data for connectivity features
    • Atomic Transact - Processes financial transaction data
    • Personetics - Receives financial activity data to generate personalized insights
    • Pinwheel - Receives payroll and income data
    • MiSnap (Mitek) - Processes images of identity documents

    Understanding the Scores

    CategoryScore
    Security68/100
    Privacy52/100
    Data Security75/100
    Network Security95/100
    Code Safety65/100
    Data Collection50/100
    Data Sharing45/100
    User Control60/100

    Positive Security Features

    • The app integrates multiple specialized fraud detection and bot prevention services, adding layered protections around financial transactions.
    • Network communications score 95/100, reflecting strong protections for data moving between the app and banking servers.

    Areas for Improvement

    • Behavioral data, including navigation patterns and session activity, is shared with multiple analytics and session-recording services simultaneously. Reducing the number of parties receiving this data would meaningfully narrow user exposure.
    • The device is profiled by ThreatMetrix without clear in-app disclosure or controls. Greater transparency and an option to limit this profiling would improve user ability to manage how device information is used.
    • The Data Sharing score of 45/100 reflects a broad range of third-party integrations that receive personal and financial data. Providing clearer opt-out controls for non-essential data sharing would strengthen privacy protections.

    About This Analysis

    This scorecard is generated from automated static analysis of the app's code and configuration. It reflects the security and privacy practices observed in the analyzed version of the app.

    App Details

    • App Name: Citizens Bank Mobile Banking
    • Package ID: com.citizensbank.androidapp
    • Version: 25.24.0
    • Platform: Android
    • Scan Date: January 20, 2026

    Right of Reply

    Developer not yet contacted