Can I trust Wise: International Transfers?
This app did not meet two or more trust checks, has a critical issue in one, or has a red flag.
- What it means for you
- Biometric identity verification during account setup is processed on the device. The app includes code to pass usage and crash data to Firebase Analytics, Mixpanel, Braze, Facebook, and Sentry, with SDK-level opt-out controls for Braze and Singular built into the app.
- Main concern
- Auth tokens silently fall back to plaintext storage when EncryptedSharedPreferences fails
- The developer's description
- 16 million+ customers send, receive, spend and grow their money internationally with Wise. It's the fast, simple way to move money in 145+ countries and 45+ currencies. Send to 70+ countries with mid-market exchange rates. Hold 40 currencies and convert instantly at low fees.
- Third-party services
- 18
- Findings rated low or higher
- 10
Open on Google PlayOpens the app's listing on Google Play in a new tab.
Full findings
Open this scan in your dashboardThe account that ran this scan sees every finding and the Rescan button there.
Trust checks
Secure by Design
One criterion not metSecurity gaps detected
Why this result
This check looks for security issues at high severity or above in the code of this build, and at least one was recorded. Issues of this kind include a credential or token another app on the device can reach, sensitive data stored without protection, and network paths that expose information in transit.
Data Minimization
StrongTracking done right
Why this result
The check looks at analytics and attribution code for companies other than the developer: the data it reads, the companies named in code as recipients, and whether a consent step runs before that code. In this build, either no such code was recorded, or a consent step runs before it and the app's own disclosures describe the collection.
The app includes a dedicated consent screen for marketing data collection. The marketing automation and attribution services each have SDK-level controls wired to consent state: disabling tracking calls the relevant SDK methods directly, not merely a UI toggle. The attribution SDK checks the device-level tracking restriction setting before initializing, and a separate call stops all attribution tracking when consent is withdrawn. Opt-out controls are present and functional at the SDK layer. No evidence was found of marketing analytics or behavioral tracking firing before the consent screen is presented to the user.
Manifest Mismatch
One criterion not metDisclosure incomplete or contradicted
Why this result
The check compares the app's privacy disclosures against what the code does, and at least one claim did not match in this build. Mismatches of this kind include a data category collected but not disclosed, a recipient the disclosure omits, and an identifier attached to data the disclosure describes as anonymous.
User Control
StrongNo lock-in
Why this result
The check looks for a way to export the data an account has accumulated and a way to delete the account itself. In this build, either both were found, or the app has no account of its own and keeps its data on the device. For an app without an account, the developer has no server-side copy to export or delete, and deleting the app removes the data in its own storage.
No artificial barriers to leaving the service were found. As a regulated financial institution subject to data protection law, Wise is obligated to provide account closure and data portability on request. The app does not use proprietary data formats that would prevent users from retaining their transaction records. No mechanisms were found that would make it unreasonably difficult to close an account or switch to another provider.
Strengths
- Login sessions are protected by AES-256 EncryptedSharedPreferences backed by AndroidKeyStore in the primary token storage path
- Transaction approval (SCA) signing keys are generated inside AndroidKeyStore and never leave the secure enclave, with biometric authentication binding
- All API traffic uses HTTPS with JWT-signed OkHttp certificate pinning covering wise.com, transferwise.com, and wise.cn with 21 backup pin digests
- Android backup is fully disabled and data extraction rules exclude all app data from cloud backup and device transfer
- Screen recording detection and overlay attack protection are active during sensitive payment and PIN flows
- This build contains code for this item; what that code does at run time was not observed.
- FaceTec biometric liveness processing for KYC runs on-device, and the build includes no code to transmit biometric data to a server
- Location access is limited to coarse granularity with an explicit user consent flow before any access
- SDK-level opt-out controls are wired in for Braze and Singular, not just UI-level toggles
What the app contains
18 services
Third-party services the scan names in the build:
- Braze
- Mixpanel
- Singular
- Sardine AI
- Firebase Analytics
- Firebase Crashlytics
- Firebase Cloud Messaging
- Facebook SDK
- Sentry
- Rollbar
- Twilio Conversations
- Google Play Services
- Google MLKit
- FaceTec
- RootBeer
- Lottie
- MPAndroidChart
- OkHttp
Libraries
| Library | Version | Advisory |
|---|---|---|
| ExoPlayer / media3 | not recorded | none confirmed |
| Room | not recorded | none confirmed |
| Lottie | not recorded | none confirmed |
| Braze | not recorded | none confirmed |
| Facebook SDK | not recorded | none confirmed |
| Datatransport | not recorded | none confirmed |
| Google Sign-In | 12451000 | none confirmed |
| Google Play Services | 12451000 | none confirmed |
| Google Play Services Location | 12451000 | none confirmed |
| Google Maps SDK | 12451000 | none confirmed |
Show all 22 librariesShow fewer
Changes since the previous scan
- Version 9.36.2 (APK manifest: 9.19.3 / versionCode 1622), score 85.
- Score 40 before, 85 after.
- Version 9.11.1 (versionCode 1581) before, 9.36.2 (APK manifest: 9.19.3 / versionCode 1622) after.
- Score change since version 9.11.1 (versionCode 1581): +45 points.
- Since the previous scan: 16 findings added, 21 removed.
- Version 9.11.1 (versionCode 1581), score 40.
- First public scan of this app.
Method and limits
Static analysis: the decompiled code, manifest and resources of this build, read file by file. Network traffic at run time is established by a capture of the running app.
- Build SHA-256
- bd075488ddac1b049ffe8875c6f35bb0677e34abf22cced7acfb66d4f9e0cfca
- Rule pack
- citt-ruleset-2026-08-v1
- Files decompiled
- 38,744
- Scan date
- 13 August 2026
Corrections
No correction is published for this app.
Developer response
No response is published for this app.
Report an error Opens an email to [email protected] that names this app and this scan.