> However, the android Citibank mobile app refuses to do anything useful if you don't give it access to your entire file system upfront.

Considering Citi’s corporate culture, I’d attribute this to incompetence rather than malice or a desire to spy on users.

I’ll bet they’re using a third-party anti-spyware library to examine the Android FS for keyloggers/etc to protect their users’ security. It’s well-intentioned, but still idiotic.

This is the same Citibank that’s been engaged in an idiotic arms-race with Google about blocking password-safes on their online banking login page for the past 5+ years - while also allowing me to do phone-banking without any real authentication - and STILL haven’t given me an EMV Chip+PIN credit-card, while the EMV Chip+Sign card I do have from them DOES have NFC without a purchase limit... anyone could steal my wallet and “tap” a couple grand off it. Arggghhhhhh.

The “banks who think they’re smarter about security than platform vendors” trope is getting real old.

To the consumer it doesn't really matter if it's malice or ineptitude or laziness. Fact is Apple will remove your app if you try something like that, but it is not uncommon to encounter this on Android.

No, it’s because they like laundering money and the profit that brings, and hate any feature that might prove their wrongdoing empirically.

https://www.reuters.com/article/us-citigroup-fine-idUSKBN1ET...

Oh, of course - I understand most (if not all?) major banks have serious ethics issues from the top-down - but money-laundering is a business-objective and is distinct and separate from online banking security.

The $70m fine (a joke to a multi-billion-dollar company) is insignificant to the potential damages from a class-action lawsuit from a wide-ranging vulnerability in their online banking platform - hence their focus and over-engineering on their online banking security - while the risks from credit-card abuse and individual identity-theft are much more limited in scope - and are a known-quantity.