Is POLi Safe? Security, Privacy and Banking Risk Explained

POLi's current security model: accredited open banking

POLi Payments operates in New Zealand under signed open-banking agreements with the country's major banks, including ANZ, ASB, BNZ, and Westpac. In practical terms, this means POLi connects to your bank through an accredited, governed channel rather than an informal or improvised one. When you choose POLi at checkout, you're redirected to log into your own online banking directly — the same login screen you'd see going to your bank's site or app yourself — and you authorise the specific payment from there.

This architecture matters for security in a few concrete ways:

• No card numbers or long-term credentials stored by the merchant. The merchant you're paying never sees your account number, balance, or login details — only confirmation that a payment was authorised.
• Authentication happens on your bank's own platform, using whatever multi-factor authentication or security prompts your bank normally applies, rather than a separate, potentially weaker login layer.
• The connection is accredited, meaning POLi has gone through a formal process with each bank to be recognised as a legitimate, governed third-party initiator rather than an ad hoc integration.

What POLi can and can't see

A common worry is how much of your banking information gets exposed to a third party during a POLi payment. Under the current accredited model:

The underlying principle of open banking generally — and the reason regulators and banks have pushed toward accredited models — is to limit a third-party initiator to exactly the data and permissions required to complete the task you've asked it to do, nothing broader.

The older "screen-scraping" criticism, and why it's now largely superseded

If you search around, you'll find older commentary — including past criticism associated with Consumer NZ — raising concerns about POLi's earlier technical approach, which at the time relied on a method sometimes described as screen-scraping: essentially, having the user enter banking credentials into a POLi-controlled interface that then logged into the bank on the user's behalf. That was a legitimate security and trust concern at the time, because it meant a third party was, functionally, handling your raw banking credentials rather than your bank handling them directly.

Since then, the New Zealand payments and banking sector has moved toward formal open banking arrangements, and POLi's current operating model — accredited, direct-to-bank-login agreements with the major banks — reflects that shift. This is a materially different arrangement from the older screen-scraping approach: authentication now happens on the bank's own platform rather than being intercepted or re-entered through an intermediary interface. We flag this history honestly rather than pretending it never existed, because understanding what changed (and why) is more useful than either dismissing old concerns or treating them as still current.

The specific risk of using POLi for gambling payments

Separately from the technical security question, there's a legal and practical risk dimension specific to gambling that's worth being clear-eyed about. Under the Gambling Act 2003, it's an offence for a person in New Zealand to provide a system that knowingly enables NZ-based persons to bet with an overseas online casino. The obligation here is generally understood to fall most heavily on whoever is providing or facilitating that system — banks, payment processors, and similar intermediaries — rather than being framed as targeting the individual bettor, but it's exactly why NZ banks and payment processors, POLi included, are cautious about the gambling merchant category and why many gambling-related transactions get declined or blocked at the bank level.

This has a few practical implications if you're researching POLi specifically in a gambling context:

• We have not found a currently licensed online casino that accepts POLi deposits, which is consistent with this cautious regulatory environment rather than a coincidence.
• Even where a payment appears to go through on an unlicensed or offshore site, your own bank may flag, delay, or decline it on the gambling merchant category alone, independent of anything to do with POLi's technical security.
• Using any payment method — POLi or otherwise — to transact with an operator outside NZ's licensing regime carries its own separate risks around consumer protection and dispute resolution, discussed further in our withdrawals guide.

Our assessment

Taken on its own technical merits, POLi's current accredited open-banking model compares reasonably well with other online payment approaches: your credentials stay with your own bank, the merchant doesn't receive your account details, and the connection is governed by formal agreements rather than an informal workaround. The genuine risk in the gambling context isn't really about POLi's security architecture — it's about the mismatch between a cautious, bank-rail-based payment technology and a merchant category that NZ banks are legally wary of. For the fuller picture on what to use instead, see our main POLi deposit casinos guide and our comparison of POLi alternatives.

Frequently asked questions