GrapheneOS banking apps: 69 now lock you out. Google holds the key

Short answer: Most banking apps still work on GrapheneOS, but the lockout list is growing fast. On the community compatibility list, 69 of 923 banking apps are now marked incompatible, up from 12 of 529 in March 2025. Our read: the bans are not about security. They come from banks handing the "is this phone safe?" question to Google, and Google only says yes to phones running Google-certified software.

TL;DR: We pulled the full PrivSec.dev list, its git history and all 1,055 user reports behind it on GitHub. Apps that call Google's Play Integrity check got marked incompatible 18.6% of the time, against 6.5% for apps that don't, so calling Google makes a ban 2.9x more likely. The UK is the worst country on the list with 10 of 48 apps blocked, including Lloyds, Halifax and Bank of Scotland, while Germany blocks 0 of 57. Tap-to-pay failed in 32 of the 79 reports that tested it.

Key numbers

What	Number	Source, checked Oct 25 2026
Banking apps on the GrapheneOS community list	923 in 82 countries	PrivSec.dev list (commit Oct 19 2026)
Marked incompatible (struck through)	69 (7.5%)	PrivSec.dev source, our count
Marked incompatible, March 2025	12 of 529 (2.3%)	Same file, git history, our count
User reports on the tracker	1,055	PrivSec-dev/banking-apps-compat-report
Ban rate, apps that call Play Integrity vs apps that don't	18.6% vs 6.5% (2.9x)	422 reports that answer the question, our count
UK apps blocked	10 of 48	PrivSec.dev list, our count
German apps blocked	0 of 57	PrivSec.dev list, our count
Tap-to-pay failures	32 of 79 tested	Tracker reports with an NFC answer
GrapheneOS releases, Jun 21 to Oct 21 2026	20	GrapheneOS releases feed
GrapheneOS Wikipedia views, last 12 months vs 2022	361,320 vs 110,471 (3.3x)	Wikimedia pageviews API

The thread that started this: "around 10%" of bank apps ban you

On Oct 23 the GrapheneOS project posted that "around 10% of banking apps are unavailable due to banning using a non-Google-approved OS," and that around a dozen banks had begun specifically permitting GrapheneOS. The post climbed to 644 points and 305 comments on Hacker News, the top-scoring story in our 36-hour pull.

That is GrapheneOS talking about itself, so we checked it against the only public dataset there is. It is close: the community list marks 7.5% of its 923 apps as broken, and 9.5% of the reports filed in 2026 ended in "incompatible."

GrapheneOS is a hardened, de-Googled build of Android for Pixel phones. Plain version: it is Android with more security and less Google, and that second part is exactly what some banks punish.

The lockout list tripled while the app list doubled

The list lives in one markdown file on GitHub, so every edit is public. We pulled the last commit of every quarter since Dec 2022 and counted. The list grew from 168 apps in 33 countries to 923 apps in 82 countries.

The struck-through entries grew faster. After a reset in early 2025, when 10 previously blocked apps started working again and 4 were removed, the count went from 12 to 69. That is 5.8x more blocked apps on a list that only grew 1.7x.

The reset matters, because it proves bans are a choice, not a law of physics. Banks that blocked GrapheneOS in 2024 unblocked it months later. Nothing about the phones changed. The bank's settings did.

Call Google, get banned: the 2.9x gap

Since 2025 the report form asks one sharp question: does the app use the Play Integrity API? GrapheneOS shows a notification when an app calls it, so users can answer. 422 reports did, and 113 of them (26.8%) said yes.

Those 113 apps were marked incompatible 18.6% of the time. The 309 apps that never call Google were marked incompatible 6.5% of the time. Same phones, same OS, same users. The difference is whether the bank asks Google for permission.

Here is what Play Integrity actually checks, in Google's own words. The device verdict passes when "the loaded Android OS is a certified device manufacturer image." The strong verdict wants "security updates in the last year."

Read that again. A certified phone a year behind on patches can pass. A GrapheneOS phone that got its 20th release in four months fails, because Google did not certify it. That is not a security test. It is a membership card, and Google owns the club.

Follow the money: who wins, who loses

Google wins twice. Every bank that leans on Play Integrity makes Google Play services a hard dependency for banking, and the GrapheneOS team says the same about tap-to-pay: "Google Pay bans using GrapheneOS and most banks around the world delegate this to Google Pay." Their summary: "Google Pay has a monopoly outside of Europe which is the main problem."

The reports back it up. Of the 79 that tested tap-to-pay, 32 said it does not work, 36 said it works, and 11 said it works only through another service. When phone payments run through Google, Google decides whose phone counts.

Banks win something too: a cheap liability shield. If fraud happens on a Google-certified phone, the bank followed "industry standard." Outsourcing trust to Google costs a bank nothing, and the 7.5% of customers it locks out are not loud enough to matter. Yet.

Users lose. 156 of 734 reports with an install answer (21.3%) got the app from the Aurora Store instead of Google Play, often because Play hides the app from phones that fail the check. People are side-loading their own bank to dodge a gate the bank does not even run.

The UK is the worst offender. Germany blocks nobody

Break the list down by country and one result jumps out. The UK has 10 of its 48 listed apps struck through, 20.8%, the most blocked apps of any country.

The UK list: Lloyds Bank, Halifax and Bank of Scotland, three brands of Lloyds Banking Group and its 30 million customers, plus MBNA, M&S Banking, Tide, Mettle, Vanquis, Aqua and AIB (NI). Hey @LloydsBank, one group, three locked doors.

Germany has 57 listed apps and zero blocked. The US has 4 of 87 (Citizens Bank, Openbank U.S., PSECU and ATH Movil). Our bet on why: the GrapheneOS team says Curve Pay, PayPal and "many European banking apps permit tap-to-pay," and that the European trend of handing tap-to-pay to Google Pay "has largely stopped." The UK left the EU and kept the Google habit. Nobody has proven the link yet, but the pattern is loud.

Governments are doing it too

The scariest entries are not banks. Denmark's national digital ID MitID, Norway's BankID login and Brazil's government app gov.br are all marked incompatible.

That means a state lets a California company decide which citizens can log in to public services from their own phone. Pro-market or not, that is a single point of control nobody voted for.

And the fix exists. GrapheneOS publishes an attestation compatibility guide showing banks how to use Android's standard hardware attestation, which it calls "a much stronger form of attestation than the Play Integrity API with the ability to whitelist the keys of alternate operating systems." The dozen banks that now permit GrapheneOS took that path. The rest chose not to.

The trend: more users, more bans, same excuse

Interest is not slowing. English Wikipedia views of the GrapheneOS page hit 361,320 from Oct 2025 to Sep 2026, 3.3x the 110,471 of 2022, with a peak of 46,306 in July 2026.

New reports ending in "incompatible" went from 4.4% in 2024 to 9.7% in 2025 and 9.5% in 2026 so far. Our prediction, on the record: by Oct 25 2027 more than 10% of the list is struck through, and the UK still leads it, unless regulators treat Play Integrity the way the EU treated app store payments. The pattern says the more people leave Google's Android, the more Google's gate gets used to pull them back.

What this means for you

If you are switching to GrapheneOS, check your bank on the PrivSec.dev list first, keep your bank's website login working as a backup, and try the Aurora Store before you give up on an app. If your bank blocks you, file a report on the tracker and send the bank the attestation guide. Public counts are the only pressure that has ever flipped a bank.

If you build apps, do not hand your trust decision to Google by default. Hardware attestation lets you check the phone yourself and keep every secure user. Shipping an app and want a second pair of eyes before launch? Our $49 Launch Check reviews it end to end, and we keep fixing the report at no extra cost until it does what it promises.

More from us: the Tensorust news desk, our AI and big tech coverage, how Google bricked Nest thermostats on their 14th birthday, why Gmail's privacy promise now ends in "unless", and how 98 of 98 Danish towns still log in through Microsoft.

Sources

• PrivSec.dev, Banking Applications Compatibility with GrapheneOS, last updated Oct 20 2026, pulled Oct 25 2026
• PrivSec-dev/privsec.dev, list source file and 161 commits, Oct 2022 to Oct 19 2026
• PrivSec-dev/banking-apps-compat-report, 1,055 app reports, pulled Oct 25 2026
• GrapheneOS on Mastodon, banking apps thread, Oct 23-24 2026
• Hacker News, "Around a dozen banking apps began specifically permitting GrapheneOS", 644 points, Oct 25 2026
• Google, Play Integrity API integrity verdicts, checked Oct 25 2026
• GrapheneOS usage guide, banking apps, checked Oct 25 2026
• GrapheneOS, attestation compatibility guide, checked Oct 25 2026
• GrapheneOS releases feed, 20 releases Jun 21 to Oct 21 2026
• Wikipedia, Lloyds Banking Group, checked Oct 25 2026
• Wikimedia pageviews API, GrapheneOS article, Jan 2022 to Oct 24 2026