According to Exodus Privacy, the NFCU app uses 5 different trackers: Adobe Experience Cloud, AltBeacon, Google CrashLytics, Google Firebase Analytics and Salesforce Marketing Cloud. As much as I detest Google, their 2 pieces of tracking software at least have a technical purpose. The other 3 are pure marketing. By using these, NFCU, MY BANK (excuse me, MY CREDIT UNION) is trying to make money off my private information. Second, this is the only app I use that, when I sign in and authenticate with a text message, it triggers a notification from Google Play Services that it (Google Play Services, not the NFCU app) wants SMS permission (even though I use Signal). No other app does this. And finally, NFCU uses ONLY text messages for 2FA. Besides using nothing at all, that's the least secure method. At a bare minimum, it should use some kind of standard ToTP app (if they follow standards, they could easily build that into this app). The best solution would be if they used standard FIDO2/WebAuthn hardware devices.