Credit Union Mobile Banking App

Biometric sign-in is only as strong as what sits behind it. In this app, Face ID and fingerprint unlock device-bound keys held in the iOS Keychain and Android Keystore, rather than simply revealing a stored password. Higher-risk actions, such as sending a payment to a new payee, trigger step-up authentication.

Certificate pinning protects the connection between the app and the credit union's servers, so a compromised network cannot quietly intercept members' sessions.

• Face ID and fingerprint linked to device-bound keys
• Step-up authentication for payments
• Certificate pinning on every API call

Losing a card at night used to mean waiting for the office to open. Now a member can freeze the card in the app immediately, unfreeze it when it turns up, set spending limits or report it lost — without calling anyone. The change takes effect straight away through the core banking APIs.

It is a small feature with an outsized effect on how secure members feel, and it removed a whole category of anxious phone calls for staff.

Savings goals let members name a target, track progress visually and move money towards it in a couple of taps. Optional round-ups round each card payment up to the next whole amount and send the difference to the chosen savings account, turning spare change into steady saving.

For the credit union, this was a genuinely new product. Encouraging saving is central to its purpose, and the app made it part of members' everyday spending rather than something they had to remember to do.

• Named goals with visible progress
• Optional round-ups into a chosen account
• Built on the credit union's existing savings products

Faster payments include confirmation of payee, which checks that the name entered matches the account before money is sent, with clear warnings when it does not. Open banking connections allow members to see and move money in ways they expect from modern apps.

Quality and security were built into the process. Detox end-to-end tests exercise the critical journeys on real builds, and an independent penetration test was passed before launch, with every finding closed pre-release.