CITT

    Scan results

    ANZ goMoney New Zealand

    Android

    Manage your everyday banking including account balances, transfers, payments, cards, home loans, business accounts, and KiwiSaver. Protected with high-grade encryption, OnlineCode authentication, and security timeouts.

    CITT SCORE
    88
    out of 100
    TRUSTED

    Quick Verdict

    Best for: ANZ customers comfortable with behavioral monitoring

    Not For: Users who object to behavioral biometric tracking

    What It Means For You

    Tap and swipe patterns are continuously monitored by a behavioral biometrics service to detect fraud. In-app activity is shared with Adobe Analytics. Third-party services also handle identity verification, meaning personal data passes through providers outside ANZ directly.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (7)

    Data Security

    1 total
    1 Info

    Network Security

    1 total
    1 Low

    Code Security

    1 total
    1 Medium

    Privacy

    3 total
    3 High

    Third-Party Risk

    1 total
    1 Info

    Third-Party Services

    BioCatch, Firebase Messaging, Firebase Crashlytics, Adobe Analytics, IDVerse, Atomic SDK, Google Maps, MLKit, Glide, Picasso, Lottie

    Security Strengths

    • ✓Certificate pinning implemented (dual-layer: OkHttp + Network Security Config)
    • ✓Android KeyStore with biometric binding and StrongBox support
    • ✓Access tokens stored in-memory only (no disk persistence)
    • ✓No custom TrustManager bypasses or SSL validation circumvention
    • ✓WebView file access completely disabled
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    biometric auth
    location
    camera
    behavioral tracking

    Package

    nz.co.anz.android.mobilebanking

    Version

    7.0.3522

    Analysis Date

    Feb 15, 2026

    Classes Analyzed

    22,186

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Trustworthy

    Key Findings

    Data Security - 1 finding (1 info)

    Network Security - 1 finding (1 low)

    Code Safety - 0 findings

    Privacy - 3 findings (3 high)

    Privacy Concerns

    What Data is Collected

    The app collects behavioral biometric data reflecting how a user physically interacts with their device, crash and performance diagnostics, in-app activity patterns, and personal details submitted during identity verification. Location data is accessed through Google Maps integration.

    Third-Party Data Sharing

    User data is shared with the following external services:

    • BioCatch - Receives behavioral biometric data for fraud detection
    • Adobe Analytics - Receives in-app activity for analytics
    • IDVerse - Receives personal details for identity verification
    • Firebase Messaging - Handles push notification delivery
    • Firebase Crashlytics - Receives crash reports and diagnostic data
    • Atomic SDK - Handles in-app messaging
    • Google Maps - Accesses location for map features
    • MLKit - On-device processing for certain features
    • Glide / Picasso / Lottie - Used for media rendering

    Understanding the Scores

    CategoryScore
    Security92/100
    Privacy85/100
    Data Security100/100
    Network Security100/100
    Code Safety95/100
    Data Collection85/100
    Data Sharing92/100
    User Control80/100

    Positive Security Features

    • All data stored on the device is fully protected, earning a perfect score in data security
    • All network communications are fully secured, with no weaknesses observed in how the app transmits data
    • The app's code is well-structured with strong protections in place, reflected in the high code safety score
    • Behavioral biometric monitoring actively works to detect unauthorized access to user accounts in real time

    Areas for Improvement

    • Behavioral biometric data is shared with a third-party provider; the app gives users limited visibility into how long that data is kept or how it may be used beyond fraud detection.
    • Identity verification involves external providers, so sensitive personal details pass through services outside of ANZ's direct control.
    • User controls over data collection and sharing could be clearer, giving users more straightforward options to understand and manage what information is shared with third parties.

    About This Analysis

    App Details

    FieldValue
    App NameANZ goMoney New Zealand
    Packagenz.co.anz.android.mobilebanking
    Version7.0.3522
    PlatformAndroid
    Scan Date2026-02-15

    This scorecard is produced by automated static analysis of the app's code and configuration. Scores reflect observed practices, data flows, and third-party integrations at the time of the scan. This report is intended to help users make informed decisions about the apps they use.

    Right of Reply

    Developer not yet contacted