CITT

    Scan results

    BNZ Mobile

    Android

    Official banking app from Bank of New Zealand enabling secure account management, money transfers, bill payments, and mobile top-ups. Features biometric login, transaction history, payment automation, and integration with Google Pay.

    CITT SCORE
    48
    out of 100
    unTRUSTED

    Quick Verdict

    Best for: BNZ customers comfortable with behavioral analytics

    Not For: You avoid apps that monitor your in-app behavior

    What It Means For You

    In-app banking behavior is monitored by BioCatch, a behavioral biometrics service, and usage patterns are tracked by Dynatrace and Firebase Analytics. User data is handled with several serious protection concerns identified across storage and network layers. Feature availability is controlled remotely via LaunchDarkly, meaning the user experience can change without an app update.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (13)

    Data Security

    6 total
    2 Critical
    4 High

    Network Security

    2 total
    1 Critical
    1 High

    Code Security

    2 total
    1 Critical
    1 High

    Privacy

    3 total
    1 Critical
    1 High
    1 Medium

    Third-Party Services

    BioCatch, Dynatrace, Firebase/Google Analytics, Google Maps, Atomic.io, LaunchDarkly, Firebase Cloud Messaging, Glide, Lottie, MPAndroidChart

    Security Strengths

    • ✓Comprehensive root detection (50+ packages plus Play Integrity API)
    • ✓Strong code obfuscation (ProGuard/R8 with 3,329+ classes)
    • ✓Strict HTTPS enforcement (no cleartext traffic)
    • ✓Android backup disabled
    • ✓Strong token encryption (AES-256-GCM with Android Keystore)
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    financial
    sensitive data
    biometric data
    location
    behavioral tracking
    third party analytics
    gdpr risk
    pci dss

    Package

    nz.co.bnz.droidbanking

    Version

    9.39.0 (Build 281759970)

    Analysis Date

    Feb 10, 2026

    Classes Analyzed

    2,264

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Use With Caution

    Key Findings

    Data Security - 6 findings (2 critical, 4 high)

    Network Security - 2 findings (1 critical, 1 high)

    Code Safety - 0 findings

    Privacy - 3 findings (1 critical, 1 high, 1 medium)

    Privacy Concerns

    What Data is Collected

    BioCatch profiles how users physically interact with the app, capturing touch gestures and input patterns to build a behavioral model tied to user identity. Dynatrace and Firebase Analytics collect session activity, device identifiers, and performance data each time the app is opened. Location data may be processed when users access branch or ATM map features powered by Google Maps.

    Third-Party Data Sharing

    User data is shared with the following services:

    • BioCatch - Behavioral biometrics for fraud detection
    • Dynatrace - Session and performance monitoring
    • Firebase/Google Analytics - Usage tracking and crash reporting
    • Google Maps - Location-based branch and ATM features
    • Atomic.io - In-app messaging and notifications
    • LaunchDarkly - Remote feature flag management
    • Firebase Cloud Messaging - Push notifications
    • Glide - Image loading
    • Lottie - Animation rendering
    • MPAndroidChart - Data visualization

    Understanding the Scores

    CategoryScore
    Security45/100
    Privacy50/100
    Data Security40/100
    Network Security45/100
    Code Safety50/100
    Data Collection60/100
    Data Sharing65/100
    User Control70/100

    Positive Security Features

    • None identified in this version of the app.

    Areas for Improvement

    • Sensitive information stored on the device should be better protected against access by other apps installed on the same device.
    • Data sent between the app and its servers should be secured more consistently across all connections.
    • Clearer disclosure is needed around how behavioral data collected by third-party services is used, retained, and shared beyond the app.

    About This Analysis

    This scorecard is based on static analysis of the app's code and configuration. Results reflect the state of the app at the time of the scan and may not reflect subsequent updates.

    App Details

    FieldValue
    App NameBNZ Mobile
    Package IDnz.co.bnz.droidbanking
    Version9.39.0 (Build 281759970)
    Scan Date2026-02-10
    PlatformAndroid

    Right of Reply

    Developer not yet contacted