BNZ Mandatory Data Collection

Please note this sub-forum does not provide professional finance advice. You should seek advice from a licensed financial advisor.

To post in this sub-forum you must have made 100 posts or have Trust status or have completed our ID Verification.

If investing please consider our affiliate link for new accounts: Sharesies.

Forums › Finance and wealth management › BNZ Mandatory Data Collection

1 | 2 | 3 | 4 | 5

1058 posts

Uber Geek
+1 received by user: 167

Trusted

#3459329 6-Feb-2026 12:36

My concern about this is the lack of information about it. Not just specifically what they're collecting, but when do they collect it (when I'm using the app or all the time?), who gets to see the data, what do they keep and how do long they keep it for, what they use it for - e.g. how do they decide when to intervene and what is that intervention? Do I lose access to my accounts? Do I get a phone call? An email? What if I'm overseas? etc.

freitasm

BDFL - Memuneh
80652 posts

Uber Geek
+1 received by user: 41045

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#3459330 6-Feb-2026 12:39

@tinytim

It's all here https://www.bnz.co.nz/about-us/governance/privacy-policy

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

TinyTim

1058 posts

Uber Geek
+1 received by user: 167

Trusted

#3459334 6-Feb-2026 13:15

That answers some questions (they keep behavioural biometrics for three years), doesn't answer other questions (how do they decide if I'm being scammed or someone has hacked my account, and what happens)... and raises some new concerns:

We share personal information with a range of third parties who help us deliver and manage our products or services. These third parties include:

[...]
social media platforms and other digital advertisers for targeted advertising

Sorry, they're sharing my personal information with social media? Really?

freitasm

BDFL - Memuneh
80652 posts

Uber Geek
+1 received by user: 41045

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#3459335 6-Feb-2026 13:17

If they're running restarted ads they probably provide a list of emails to th platforms.

It makes sense to not disclose how they determine someone is being scammed, as that information can be used by scammers that evade detection.

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

gzt

18684 posts

Uber Geek
+1 received by user: 7824

Lifetime subscriber

#3459344 6-Feb-2026 13:39

Lias: and wow I was a bit shocked when I clicked on the more information page.

typing - how fast you type, your rhythm, and common errors

mouse - how you move it, click, and scroll

device use - how you hold, tilt, or move it.

type and model

preferences, settings, and sensor information

network and connectivity data

IP address

installed apps

It's compulsory, and if you don't agree to all that data being collected, you can no longer bank electronically with BNZ.

Am I overreacting in thinking it's time to find a new bank?

Imo there are a large number of apps and sites collecting this data. I'd guess BNZ is ethical in the sense it is telling you about it, and complies with the NZ privacy act. In theory it should be used only for fraud detection heuristics. In practice I haven't read BNZ's disclosure statement.

gzt

18684 posts

Uber Geek
+1 received by user: 7824

Lifetime subscriber

#3459346 6-Feb-2026 13:53

TinyTim:
That answers some questions (they keep behavioural biometrics for three years), doesn't answer other questions (how do they decide if I'm being scammed or someone has hacked my account, and what happens)... and raises some new concerns:

We share personal information with a range of third parties who help us deliver and manage our products or services. These third parties include:

[...]

social media platforms and other digital advertisers for targeted advertising

Sorry, they're sharing my personal information with social media? Really?

Privacy statements are often super-wide to allow almost anything they might do now or in the future or cover a range of systems not just one. In practice I'm guessing it's more likely they are sharing an anonymous id which is relatively difficult (but maybe not impossible) to track back to you personally. Then if they offer to facilitate things like social reviews of the app or services there is obviously some more relationship there. If for example their site uses a third party service then they are responsible even in the case it is associated with an id only on the browser side and they don't necessarily know about that id server side.

Dell

Shop now for Dell laptops and other devices (affiliate link).

gzt

18684 posts

Uber Geek
+1 received by user: 7824

Lifetime subscriber

#3459350 6-Feb-2026 14:06

Classic case where the ACT Party had a list of email newsletter subscribers and David Seymour uploaded those email addresses to Facebook to personally target those subscribers:

https://newsroom.co.nz/2020/10/13/act-may-have-breached-privacy-law-with-targeted-ads/

The ACT party argued along the lines of: 'our privacy policy says we can do nearly anything'. Experts said things like 'technical breach' - which is exactly not the way you would feel if you only signed up for a newsletter and found your browsing had been taken over by ACT party advertising.

freitasm

BDFL - Memuneh
80652 posts

Uber Geek
+1 received by user: 41045

Administrator

ID Verified

Trusted

Geekzone

Lifetime subscriber

#3459351 6-Feb-2026 14:11

A good example that shows you should worry more about politicians than banks...

Referral links: Quic Broadband (free setup code: R587125ERQ6VE) | Samsung | AliExpress | Wise | Sharesies

Support Geekzone by subscribing (browse ads-free), or making a one-off or recurring donation through PressPatron.

michaelmurfy

meow
13580 posts

Uber Geek
+1 received by user: 10910

Moderator

ID Verified

Trusted

Lifetime subscriber

#3459355 6-Feb-2026 14:44

@cddt: But now the banks do support POLI, I assume it's no longer against the T&Cs...

Forced to switch to open banking so no-longer screen scraping.

Michael Murphy | https://murfy.nz
Referral Links: Quic Broadband (use R122101E7CV7Q for free setup)

Are you happy with what you get from Geekzone? Please consider supporting us by subscribing.
Opinions are my own and not the views of my employer.

TinyTim

1058 posts

Uber Geek
+1 received by user: 167

Trusted

#3459378 6-Feb-2026 18:54

freitasm:

It makes sense to not disclose how they determine someone is being scammed, as that information can be used by scammers that evade detection.

Of course, but I want to know if, for example, I go to a different city to buy an expensive car I've seen advertised by someone who I've never paid before - am I at risk of being locked out of my internet banking because it triggers some fraud alert? Or for example if I'm in Sydney helping my son who's just moved there for a job get his new flat set up, and put a wad of cash in his new NAB account (maybe while he reads me the new number out over the phone)?

gzt

18684 posts

Uber Geek
+1 received by user: 7824

Lifetime subscriber

#3459382 6-Feb-2026 19:31

I would think not, and if you did it would be easily resolvable with a phone call. I'd take a mobile device and use that before and during rather than rely on random computers. You'll need your mobile device anyway for sms confirmation of any significant changes or transfers. I assume your bank does that.

Samsung

Shop now on Samsung phones, tablets, TVs and more (affiliate link).

michaelmurfy

meow
13580 posts

Uber Geek
+1 received by user: 10910

Moderator

ID Verified

Trusted

Lifetime subscriber

#3459387 6-Feb-2026 20:22

@TinyTim I don’t know how many times I need to say “there’s nothing to worry about” in this thread…

BarTender

3629 posts

Uber Geek
+1 received by user: 2572

ID Verified

Trusted

Lifetime subscriber

#3459390 6-Feb-2026 20:43

I think it's also safe to say that all major banks will have or will shortly be implementing some sort of behavioural analytics to prevent fraud be it BioCatch or some other third party if not already implemented them.

The two drivers would be as already pointed out:

The non-trivial change in the privacy act that all banks need to comply with and the big ones would be especially sensitive to not wanting to be made an example of now this new legislation has come into effect
Fraud is continually evolving and costs the banks and their customers hundreds of thousands per month and ultimately we all pay for that one way or another and BioCatch seems to be a market leader in this space.

So I look at it in the reverse to the OP, I would be more concerned if the bank wasn't wanting to manage their fraud risk.

gzt

18684 posts

Uber Geek
+1 received by user: 7824

Lifetime subscriber

#3459392 6-Feb-2026 20:54

michaelmurfy:
@cddt: But now the banks do support POLI, I assume it's no longer against the T&Cs...
Forced to switch to open banking so no-longer screen scraping.

Oh really that's good news. Maybe I should try it now.

TinyTim

1058 posts

Uber Geek
+1 received by user: 167

Trusted

#3459395 6-Feb-2026 21:29

michaelmurfy:

@TinyTim I don’t know how many times I need to say “there’s nothing to worry about” in this thread…

And I appreciate all the information you've provided (far more than the bank). But I still don't know the risk: what's the chance of a false positive and what's the impact? (what's the bank going to do when it believes it's detected fraud?)

1 | 2 | 3 | 4 | 5