CITT

    Scan results

    ASB Mobile Banking

    Android

    ASB Mobile Banking puts secure banking in your pocket with real-time payments, transfers, card control, and statement management. Manage your money anytime, anywhere with account access, payment options, spending tracking, and goal planning features.

    CITT SCORE
    35
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: ASB customers comfortable with standard analytics

    Not For: You want a banking app with strong data protection

    What It Means For You

    App activity and crash data is shared with Adobe, Google, and Firebase. User location may be accessed via Google Maps integration. The app has several serious weaknesses in how financial data is stored and protected on the device.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (15)

    Data Security

    6 total
    4 Critical
    1 High
    1 Medium

    Network Security

    2 total
    2 Medium

    Code Security

    5 total
    2 Critical
    2 High
    1 Medium

    Privacy

    2 total
    2 High

    Third-Party Services

    Adobe Marketing Cloud, Akamai Bot Manager, Firebase Crashlytics, Firebase Cloud Messaging, Google Maps

    Security Strengths

    • ✓No SQL injection vulnerabilities (no SQL database usage)
    • ✓Secure random number generation (no insecure Random usage)
    • ✓No known CVEs in third-party SDKs
    • ✓Session tokens stored in-memory only
    • ✓WebView file access disabled
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    banking
    analytics
    location
    push notifications

    Package

    nz.co.asb.asbmobile

    Version

    26.01.0 (versionCode: 25485979)

    Analysis Date

    Feb 8, 2026

    0

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 6 findings (4 critical, 1 high, 1 medium)

    Network Security - 2 findings (2 medium)

    Code Safety - 0 findings

    Privacy - 2 findings (2 high)

    Privacy Concerns

    What Data is Collected

    The app collects in-app activity, crash and diagnostic data, and location information through its Google Maps integration.

    Third-Party Data Sharing

    Data is shared with the following third-party services:

    • Adobe Marketing Cloud - marketing and behavioral analytics
    • Akamai Bot Manager - traffic filtering and bot detection
    • Firebase Crashlytics - crash reporting and diagnostics
    • Firebase Cloud Messaging - push notification delivery
    • Google Maps - location services

    Understanding the Scores

    CategoryScore
    Security25/100
    Privacy45/100
    Data Security15/100
    Network Security60/100
    Code Safety30/100
    Data Collection50/100
    Data Sharing55/100
    User Control40/100

    Positive Security Features

    • No notable positive security practices were identified in this version of the app.

    Areas for Improvement

    • Financial data stored locally on the device is not adequately protected, meaning user data may not be fully protected if the device is lost or stolen.
    • The app's internal code structure has significant weaknesses that could allow someone with device access to retrieve sensitive account information.
    • Users have limited ability to control what personal data the app collects or opt out of sharing it with third-party analytics services.

    About This Analysis

    This scorecard is based on automated static analysis of the app's published code and configuration. It reflects the app as it existed at the time of the scan and may not capture all runtime behaviors.

    App Details

    FieldValue
    App NameASB Mobile Banking
    Package IDnz.co.asb.asbmobile
    Version26.01.0 (25485979)
    Scan Date2026-02-08
    PlatformAndroid

    Right of Reply

    Developer not yet contacted