In my experience with UK banks & financial institutions, GrapheneOS support can be roughly divided into four types.

None. Explicitly banned. And, though I feel bad for saying it, I can't blame them. If some idiot roots their phone and downloads malware, the bank may be responsible for refunding them. I can see why they don't want that headache.

Some. App works, but some functionality is unavailable. I've got a credit card app which works, but refuses to set up virtual cards or use "remember me". That's good enough for my use. Similarly, I had a merchant account which let me see my balance, but I couldn't use my phone as a credit card reader.

Works, but only in main profile. I'd rather keep financial things in a locked profile. But lots of banks disallow that.

Full. Everything works (although you may need to toggle some exploit protection off).

Some banks are reasonably good at letting you pass on technical queries to their developers - mostly the smaller ones. The nice thing about the UK banking sector is that it is trivial to move banks. So I switched accounts to providers which worked with my phone and let the old ones know why I was moving.

Without evidence that using an OS that isn't approved by Google or Apple actually correlates with a higher rate of account compromise or fraud, I do blame them for trying to force it on users.

I've done a couple casual web searches for such evidence and come up short. If somebody has good data on this, I don't think they're publishing it.

I have two to add: Works, but only every other app version. Second: works if the aosp keyboard or gboard are active but not with LeanType. Easy fix once you know, but that was not a fun time debugging.

> The nice thing about the UK banking sector is that it is trivial to move banks.

Are there countries where this is a hassle? Now I've only had personal banking accounts in ~3 countries (so far?), so maybe I'm in a bubble, but in none of the countries has "switching banks" been more than basically create a new account, start using new IBAN for incoming transfers, move direct debits to use new IBAN and start using new card(s). Those last two were even automatic in the last move I did for a lot of stuff. Is it typically more difficult than that in other countries?

> None. Explicitly banned. ... I can't blame them. If some idiot roots their phone and downloads malware, the bank may be responsible for refunding them. I can see why they don't want that headache.

I mean this is the whole reason GrapheneOS does not ship a rooted version that they attest to. I doubt they are explicitly banning GrapheneOS, what they are doing is only trusting Google attestation.

The reason some banks explicitly allow GrapheneOS is because its easy for them to also trust GrapheneOS attestation, because it is not a rooted OS, and sensible security teams in banks can see that its more secure than any other Android phone including Pixels.

I wish people would understand this better, its what gives GrapheneOS a fighting chance of becoming a legitimate open source mobile OS that is accepted as secure for consumer use and that is not controlled by Apple or Google.

> though I feel bad for saying it, I can't blame them. If some idiot roots their phone and downloads malware, the bank may be responsible for refunding them. I can see why they don't want that headache.

Most of us understand the desire to protect customers from fraud, but I don't think we should accept blanket restrictions on everyone's freedom simply because some people might make poor security decisions.

There's also the unspoken/uncomfortable economic reality here: the optimal level of fraud isn't zero. At some point, the cost of preventing additional fraud, including the loss of individual choice and autonomy, exceeds the benefit.

Could we aim for proportionate, evidence-based security rather than treating the least capable user as the benchmark for everyone?