# Security & Privacy Scorecard

## Citizens Bank Mobile Banking

**Security Score: 68/100** | **Privacy Score: 52/100**

Version 25.24.0 | Analyzed January 20, 2026

## What This Means for You

In-app behavior, navigation patterns, and session activity are recorded by Glassbox Digital and shared with Adobe Analytics and Firebase. Device identity is fingerprinted by ThreatMetrix for fraud detection, which involves profiling device details. Financial actions like Zelle transfers involve additional third-party processors who receive transaction data.

## Recommendation: Use With Caution

**Best For:** Citizens Bank customers comfortable with behavioral

## Key Findings

**Data Security** - 3 findings (1 high, 2 medium)

**Network Security** - 1 finding (1 info)

**Code Safety** - 0 findings

**Privacy** - 1 finding (1 critical)

## Privacy Concerns

### What Data is Collected

The app collects in-app behavioral data including navigation patterns, session activity, and interactions within the app. Device characteristics are gathered to build a device profile used for fraud detection. Transaction details are processed and shared with financial service partners depending on the features used.

### Third-Party Data Sharing

Data is shared with the following third parties:

- **Glassbox Digital** - Records in-app behavior and session activity
- **Adobe Analytics** - Receives usage and behavioral data
- **Firebase Analytics** - Receives app usage events and activity data
- **Ensighten** - Manages data distribution to third-party services
- **Branch.io** - Receives attribution and marketing measurement data
- **Qualtrics** - Receives survey responses and feedback
- **ThreatMetrix** - Receives device details for fraud detection profiling
- **Akamai Bot Manager** - Analyzes traffic patterns for security purposes
- **Transmit Security** - Processes identity and authentication signals
- **Arkose Labs** - Analyzes interaction patterns for fraud prevention
- **Fiserv (Zelle)** - Processes payment transaction data
- **Mastercard Open Banking** - Receives financial account data for connectivity features
- **Atomic Transact** - Processes financial transaction data
- **Personetics** - Receives financial activity data to generate personalized insights
- **Pinwheel** - Receives payroll and income data
- **MiSnap (Mitek)** - Processes images of identity documents

## Understanding the Scores

| Category | Score |
|---|---|
| Security | 68/100 |
| Privacy | 52/100 |
| Data Security | 75/100 |
| Network Security | 95/100 |
| Code Safety | 65/100 |
| Data Collection | 50/100 |
| Data Sharing | 45/100 |
| User Control | 60/100 |

## Positive Security Features

- The app integrates multiple specialized fraud detection and bot prevention services, adding layered protections around financial transactions.
- Network communications score 95/100, reflecting strong protections for data moving between the app and banking servers.

## Areas for Improvement

- Behavioral data, including navigation patterns and session activity, is shared with multiple analytics and session-recording services simultaneously. Reducing the number of parties receiving this data would meaningfully narrow user exposure.
- The device is profiled by ThreatMetrix without clear in-app disclosure or controls. Greater transparency and an option to limit this profiling would improve user ability to manage how device information is used.
- The Data Sharing score of 45/100 reflects a broad range of third-party integrations that receive personal and financial data. Providing clearer opt-out controls for non-essential data sharing would strengthen privacy protections.

---

## About This Analysis

This scorecard is generated from automated static analysis of the app's code and configuration. It reflects the security and privacy practices observed in the analyzed version of the app.

### App Details

- **App Name:** Citizens Bank Mobile Banking
- **Package ID:** com.citizensbank.androidapp
- **Version:** 25.24.0
- **Platform:** Android
- **Scan Date:** January 20, 2026