Banking Apps on GrapheneOS: CommBank, ANZ, Westpac, NAB — What Works
8 min read
The single most common question from prospective buyers is: 'Will my banking apps still work?' For most Australians, the answer is yes — including CommBank, ANZ, Westpac, NAB, ING, Macquarie, and the majority of other institutions.
Banking apps on a privacy phone requires understanding why they're complicated, and how GrapheneOS solves it differently from other de-Googled alternatives. The short version: GrapheneOS passes the security checks banks require, without giving Google the access it normally demands.
Why Banking Apps Are Complicated on Privacy Phones
Banking apps use Google's Play Integrity API (formerly SafetyNet) to check whether your device is 'certified'. This check verifies that: the device's bootloader is locked, Verified Boot is active, the OS hasn't been tampered with, and the device is running software Google recognises.
On a rooted Android phone, these checks fail — the bootloader is unlocked, the OS may be modified, and the device isn't in a certified state. Most banking apps refuse to run in this condition.
GrapheneOS is different. Because we re-lock the bootloader before shipping and Verified Boot is fully active, your device passes Play Integrity checks. The Titan M chip attests to the device's integrity. From the bank's perspective, you're on a legitimate, unmodified Android device — because you are.
How Sandboxed Google Play Makes It Work
GrapheneOS runs Google Play Services as a fully sandboxed, unprivileged app. On stock Android, Play Services is a privileged system app with deep access to your contacts, location, app activity, and identifiers. On GrapheneOS, it's an ordinary app that only gets the permissions you explicitly grant.
This means banking apps get the attestation they need — because the device is genuinely in a certified state — but Google's data collection is constrained by the sandbox. You can revoke Play Services' location permission, network access, and other permissions independently for each profile.
Australian Banking Apps: Compatibility
The following banks have been confirmed working on GrapheneOS with Sandboxed Google Play installed. This list reflects community testing and our own verification:
- Commonwealth Bank (CommBank / NetBank) ✓
- ANZ Mobile Banking ✓
- Westpac Mobile Banking ✓
- NAB Mobile Banking ✓
- ING Australia ✓
- Macquarie Mobile Banking ✓
- Bendigo Bank ✓
- Bank of Queensland (BOQ) ✓
- St. George / Bank of Melbourne / BankSA ✓
- Suncorp Bank ✓
- ME Bank ✓
- Up Bank ✓
- Rabobank Australia ✓
- Great Southern Bank ✓
- Teachers Mutual Bank ✓
If your bank isn't listed, it almost certainly still works — these are confirmed, not exhaustive. Install and test. If you encounter a problem, contact us.
Google Pay and Tap to Pay
Google Pay (Google Wallet) works on GrapheneOS with Sandboxed Google Play. Install it from the sandboxed Play Store, add your cards, and tap to pay as normal. The experience at point-of-sale terminals is identical to stock Android.
Contactless payment requires NFC and the Google Wallet app. Both work. You'll need a Google account in the sandboxed profile to set up Google Pay — we recommend creating a throwaway account used exclusively for this purpose.
Step-by-Step: Installing a Banking App
We recommend running banking apps in a secondary user profile to keep all Google-related activity isolated from your main profile. When you close the banking profile, GrapheneOS purges its encryption keys — Google's services go fully offline.
- Settings → System → Users → Add user (name it 'Banking' or similar)
- Switch to the new profile
- Install Google Play Services, Play Store, and Google Services Framework via the GrapheneOS installer
- Open Play Store — sign in or continue without account (most banking apps don't require an account)
- Search for and install your banking app
- Log in to your banking app as normal
- When finished banking: long-press the power button → End session (this closes the profile and purges the encryption keys)
Troubleshooting: 'Device Not Supported' or 'Rooted Device Detected'
If a banking app shows a 'device not supported' or 'rooted device' error on GrapheneOS, the most common cause is that Sandboxed Google Play Services are not fully set up in the profile.
Checklist: ensure Google Play Services, Google Play Store, and Google Services Framework are all installed. Open Play Store and let it complete its setup. Some apps require Play Protect to be active — verify it's running in Play Store settings. If the problem persists with a specific app, contact us — we investigate banking app compatibility issues and update this guide when situations change.
Frequently asked questions
- Do I need to keep Sandboxed Google Play running all the time?
- No. The secondary profile containing Google Play is completely isolated. When you end the session or switch back to your main profile, all of its encryption keys are purged. Google services only run when you're actively in the banking profile.
- Does CommBank's cardless cash feature work?
- Yes. Cardless cash is a feature of the CommBank app, which works through sandboxed Play. Both the code generation and ATM interaction work correctly.
- Do I need a Google account to use banking apps?
- Most Australian banking apps don't require a Google account — they just need Play Services for the device attestation check. Install them through the sandboxed Play Store without signing in. Google Pay is the exception: it requires a Google account.
- Will GrapheneOS affect my bank's fraud detection?
- Banks' fraud detection is based on login credentials, transaction patterns, and IP address — not device OS. GrapheneOS presents as a certified Android device and doesn't affect how your bank identifies your sessions.
- Is it against my bank's terms to use GrapheneOS?
- We're not aware of any Australian bank's terms that prohibit GrapheneOS. Banks prohibit rooted or jailbroken devices — GrapheneOS is neither. It's an unmodified Android variant running on certified hardware with the bootloader locked.
Still have questions?
We answer personally — no ticket queue.