Swish

Is Swish safe?

Yes. Swish is one of the safer payment apps we score, as long as you never let a stranger talk you into sending money. Every payment has to be signed with Mobile BankID on the same phone, Apple's label shows no data used to track you, and we found no fine against Getswish AB, the bank-owned company that runs it. Since early 2026 it has also been licensed and supervised by Finansinspektionen, Sweden's financial regulator.

The weak spot is fraud you approve yourself. Swish money arrives in seconds and is hard to claw back, which is why scammers ask for it. We score Swish 75/100, level with Vipps MobilePay, the Norwegian and Danish equivalent.

Who runs Swish and who checks it

Six banks own Getswish: Danske Bank, Handelsbanken, Länsförsäkringar, Nordea, SEB and Swedbank. The banks provide the actual payments, and your bank, not Getswish, is responsible for your payment records. Getswish says 8.7 million people and about 300,000 businesses and organisations use Swish.

For years that split meant Getswish itself had no licence. In late 2019, after SVT reported that Swish had no duty to report suspicious transactions, Finansinspektionen asked the company for information. A new clearing law brought a licence requirement in 2024, and in January 2026 FI announced it had authorised Getswish as a clearing organisation. FI can now examine its risk management, IT and cyber security, and money-laundering controls. That is supervision of the operator, not a published review of the app, so the regulatory score stays below 90.

What Swish collects

Less than most payment apps. Apple's label on the Swedish App Store lists purchases, financial information, contact details, contacts, user content and identifiers as linked to you, and usage data, diagnostics and some identifiers as not linked. Nothing is used for tracking.

Getswish's privacy notice of 6 October 2026 fills in the detail. It processes your name, mobile number, personal identity number, age and bank, plus device data such as IP address, device type and IMEI. Payment data is processed only with your consent for Getswish's own in-app services; the payment itself is your bank's responsibility. The notice describes no marketing profiling of users. Getswish and the banks share personal identity numbers and device data to stop fraud and money mules, kept for 13 months after a transaction. Data stays mainly in the EU and EEA.

One privacy trade-off is built in. The person you pay sees your name, and anyone who starts a payment to your number sees your name at the BankID step. That helps people spot a wrong recipient, but it also lets someone who has only your number learn your name.

The scams that target Swish users

Most Swish losses come from manipulation, not hacking. The Swedish Bankers' Association describes the pattern: fraudsters reach victims through spoofed phone numbers and fake texts (now the most common way in), then talk them into signing a payment or issuing a BankID. It cites police figures showing that proceeds from phone fraud fell by 40% from 2023 to 2024. Getswish also warns about calls and texts from people claiming to be Swish, and it has warned shops about fake Swish apps that show a made-up payment confirmation, and says merchants should check payments in the Swish business app or their bank account, never on the customer's screen.

The Riksbank's 2025 payments report says losses from payment fraud passed SEK 1 billion in the first half of 2024 alone, and that banks rarely refund frauds the victim authorised. Since mid-January 2026, every bank that offers Swish can put a misuser on a shared block list, which stops that person sending or receiving Swish payments at any bank.

How to use Swish safely

1. Read the name shown at the BankID step before you sign, and stop if it is not the person you expect.
2. Never open BankID or Swish because a caller asks you to. Getswish never calls, texts or emails users.
3. Set a lower weekly Swish limit in your bank's app if you rarely send large sums.
4. When selling, check the money has reached your account before you hand anything over.
5. Report a scam to your bank and the police at once; a fast report is the only chance to stop the money.

How we scored it

The regulatory record (86) is the strongest factor: no fines, and a new licence that brings real supervision, though no regulator has reviewed the app itself. Content safety (66) is the weakest, because Swish money is a common target of authorised-payment fraud in Sweden and refunds are rare. Security (78) reflects BankID on every payment and no known breach, held back by the lack of a bug bounty. For tapping to pay in shops, see Apple Wallet.