K
Klivvr Blog

Push Notification Strategies for Financial Apps

A comprehensive guide to designing, implementing, and optimizing push notification systems for fintech mobile apps, balancing user engagement with trust and regulatory compliance.

technical9 min readBy Klivvr Engineering
Share:

Push notifications in a financial app occupy a unique design space. Unlike social media notifications competing for dopamine-driven engagement, fintech notifications carry real monetary significance. A transaction alert tells a user their money moved. A fraud warning demands immediate action. A payment reminder prevents a late fee. Get these right, and notifications become the most trusted communication channel between you and your user. Get them wrong — too many, too noisy, poorly timed — and users disable notifications entirely, losing a critical security and engagement layer.

At Klivvr, our push notification system has evolved from a simple "blast alerts on every transaction" model to a nuanced, preference-aware, priority-tiered architecture. This article covers the technical implementation on iOS and Android, the categorization and prioritization strategies, and the product decisions that keep our notification opt-in rate above 85%.

Notification Architecture Overview

Our notification system has three components:

  1. Backend notification service. Responsible for deciding what to send, to whom, and when. It consumes events from the transaction processing pipeline, the fraud detection system, the marketing automation platform, and the account lifecycle service.

  2. Delivery layer. Routes notifications through Apple Push Notification service (APNs) for iOS and Firebase Cloud Messaging (FCM) for Android. Handles token management, delivery tracking, and retry logic.

  3. Client-side handling. Receives notifications, routes them to the appropriate in-app experience, and manages the local notification state (badges, notification center grouping, etc.).

The backend service is the brain of the system. It applies business rules before any notification is dispatched:

// NotificationDecisionEngine.kt
class NotificationDecisionEngine(
    private val preferencesRepository: UserNotificationPreferences,
    private val quietHoursPolicy: QuietHoursPolicy,
    private val rateLimiter: NotificationRateLimiter,
    private val priorityClassifier: NotificationPriorityClassifier
) {
    suspend fun shouldDeliver(
        userId: String,
        notification: NotificationPayload
    ): DeliveryDecision {
        val priority = priorityClassifier.classify(notification)
        val preferences = preferencesRepository.getPreferences(userId)
 
        // Critical notifications (fraud alerts, OTPs) always deliver
        if (priority == Priority.CRITICAL) {
            return DeliveryDecision.DeliverImmediately
        }
 
        // Check user preferences for this notification category
        if (!preferences.isEnabled(notification.category)) {
            return DeliveryDecision.Suppress(reason = "user_preference")
        }
 
        // Check quiet hours (non-critical only)
        if (quietHoursPolicy.isQuietHours(userId)) {
            return DeliveryDecision.Defer(
                until = quietHoursPolicy.getNextActiveTime(userId)
            )
        }
 
        // Rate limiting: max N non-critical notifications per hour
        if (!rateLimiter.allowNotification(userId, notification.category)) {
            return DeliveryDecision.Batch(
                withCategory = notification.category
            )
        }
 
        return DeliveryDecision.DeliverImmediately
    }
}

This decision engine ensures that a user who receives 30 small transactions in an hour (e.g., from a recurring micro-savings product) does not receive 30 individual push notifications. Instead, after the first few, subsequent notifications are batched into a summary: "You have 28 new transactions totaling $14.00."

Priority Tiers and Categories

Not all financial notifications are created equal. We classify notifications into four priority tiers:

Critical (P0). Must be delivered immediately, regardless of user preferences or quiet hours. Examples: suspected fraud alerts, one-time passwords (OTPs), account lockout warnings, and regulatory-required notifications. These use the highest delivery priority on both APNs and FCM.

Important (P1). Delivered promptly but subject to quiet hours and basic rate limiting. Examples: incoming transfers, successful outgoing transfers, bill payment confirmations.

Informational (P2). Subject to full preference controls, quiet hours, and aggressive batching. Examples: spending category summaries, monthly statement availability, exchange rate changes.

Promotional (P3). Lowest priority. Subject to all controls plus an additional frequency cap (maximum one per day). Examples: new feature announcements, referral program nudges, partner offers.

Each priority tier maps to platform-specific delivery parameters:

// APNs payload construction
fun buildAPNsPayload(notification: NotificationPayload, priority: Priority): APNsMessage {
    return APNsMessage(
        headers = mapOf(
            "apns-priority" to when (priority) {
                Priority.CRITICAL -> "10"  // Immediate delivery
                Priority.IMPORTANT -> "10"
                Priority.INFORMATIONAL -> "5"  // Opportunistic delivery
                Priority.PROMOTIONAL -> "5"
            },
            "apns-push-type" to "alert",
            "apns-collapse-id" to notification.collapseKey
        ),
        payload = APNsPayload(
            alert = APNsAlert(
                titleLocKey = notification.titleKey,
                locKey = notification.bodyKey,
                locArgs = notification.bodyArgs
            ),
            badge = notification.badgeCount,
            sound = when (priority) {
                Priority.CRITICAL -> "critical_alert.caf"
                Priority.IMPORTANT -> "default"
                else -> null  // Silent for lower priorities
            },
            category = notification.actionCategory,
            threadId = notification.groupId,
            interruptionLevel = when (priority) {
                Priority.CRITICAL -> "critical"
                Priority.IMPORTANT -> "time-sensitive"
                Priority.INFORMATIONAL -> "active"
                Priority.PROMOTIONAL -> "passive"
            }
        )
    )
}

The interruptionLevel field (iOS 15+) is particularly valuable. A time-sensitive notification breaks through Focus mode, ensuring that a large transfer alert reaches the user even when their phone is in Do Not Disturb. A passive promotional notification appears silently in the notification center without lighting up the screen.

iOS Client Implementation

On iOS, handling push notifications involves several coordinated pieces:

// AppDelegate.swift
class AppDelegate: UIResponder, UIApplicationDelegate, UNUserNotificationCenterDelegate {
 
    func application(
        _ application: UIApplication,
        didFinishLaunchingWithOptions launchOptions: [UIApplication.LaunchOptionsKey: Any]?
    ) -> Bool {
        UNUserNotificationCenter.current().delegate = self
        registerForPushNotifications()
        return true
    }
 
    private func registerForPushNotifications() {
        UNUserNotificationCenter.current().requestAuthorization(
            options: [.alert, .badge, .sound, .criticalAlert]
        ) { granted, error in
            guard granted else {
                NotificationAnalytics.trackPermissionDenied()
                return
            }
            DispatchQueue.main.async {
                UIApplication.shared.registerForRemoteNotifications()
            }
        }
    }
 
    func application(
        _ application: UIApplication,
        didRegisterForRemoteNotificationsWithDeviceToken deviceToken: Data
    ) {
        let token = deviceToken.map { String(format: "%02.2hhx", $0) }.joined()
        TokenRegistrationService.shared.registerAPNsToken(token)
    }
 
    // Handle notification when app is in foreground
    func userNotificationCenter(
        _ center: UNUserNotificationCenter,
        willPresent notification: UNNotification,
        withCompletionHandler completionHandler: @escaping (UNNotificationPresentationOptions) -> Void
    ) {
        let category = notification.request.content.categoryIdentifier
 
        // Show transaction alerts as banners even when app is in foreground
        if category == "TRANSACTION_ALERT" || category == "FRAUD_ALERT" {
            completionHandler([.banner, .sound, .badge])
        } else {
            // For other notifications, update in-app UI silently
            NotificationRouter.shared.handleForegroundNotification(notification)
            completionHandler([.badge])
        }
    }
 
    // Handle notification tap
    func userNotificationCenter(
        _ center: UNUserNotificationCenter,
        didReceive response: UNNotificationResponse,
        withCompletionHandler completionHandler: @escaping () -> Void
    ) {
        let userInfo = response.notification.request.content.userInfo
        DeepLinkRouter.shared.route(from: userInfo)
        completionHandler()
    }
}

The deep link router extracts the target screen from the notification payload and navigates the user to the relevant context — a specific transaction detail, a fraud review screen, or a payment confirmation page.

Android Client Implementation

On Android, FCM integration follows a similar pattern with FirebaseMessagingService:

// KlivvrMessagingService.kt
class KlivvrMessagingService : FirebaseMessagingService() {
 
    override fun onNewToken(token: String) {
        TokenRegistrationService.registerFCMToken(token)
    }
 
    override fun onMessageReceived(remoteMessage: RemoteMessage) {
        val data = remoteMessage.data
        val priority = NotificationPriority.fromString(data["priority"] ?: "informational")
        val category = data["category"] ?: "general"
 
        when (priority) {
            NotificationPriority.CRITICAL -> showCriticalNotification(data)
            NotificationPriority.IMPORTANT -> showImportantNotification(data)
            else -> showStandardNotification(data)
        }
    }
 
    private fun showCriticalNotification(data: Map<String, String>) {
        val channelId = "critical_alerts"
        val notification = NotificationCompat.Builder(this, channelId)
            .setSmallIcon(R.drawable.ic_alert)
            .setContentTitle(data["title"])
            .setContentText(data["body"])
            .setPriority(NotificationCompat.PRIORITY_MAX)
            .setCategory(NotificationCompat.CATEGORY_ALARM)
            .setAutoCancel(true)
            .setContentIntent(createDeepLinkIntent(data))
            .addAction(createFraudReportAction(data))
            .build()
 
        val manager = getSystemService(NotificationManager::class.java)
        manager.notify(data["notification_id"]?.toInt() ?: 0, notification)
    }
 
    private fun createDeepLinkIntent(data: Map<String, String>): PendingIntent {
        val intent = Intent(this, MainActivity::class.java).apply {
            flags = Intent.FLAG_ACTIVITY_NEW_TASK or Intent.FLAG_ACTIVITY_CLEAR_TOP
            putExtra("deep_link", data["deep_link"])
        }
        return PendingIntent.getActivity(
            this, 0, intent,
            PendingIntent.FLAG_UPDATE_CURRENT or PendingIntent.FLAG_IMMUTABLE
        )
    }
}

Android's notification channel system (required since Android 8.0) maps cleanly to our priority tiers:

// NotificationChannelManager.kt
fun createNotificationChannels(context: Context) {
    val manager = context.getSystemService(NotificationManager::class.java)
 
    val channels = listOf(
        NotificationChannel(
            "critical_alerts",
            "Security Alerts",
            NotificationManager.IMPORTANCE_HIGH
        ).apply {
            description = "Fraud alerts and security warnings"
            setBypassDnd(true)
            lockscreenVisibility = Notification.VISIBILITY_PUBLIC
        },
        NotificationChannel(
            "transaction_alerts",
            "Transaction Alerts",
            NotificationManager.IMPORTANCE_DEFAULT
        ).apply {
            description = "Notifications for incoming and outgoing transactions"
        },
        NotificationChannel(
            "account_updates",
            "Account Updates",
            NotificationManager.IMPORTANCE_LOW
        ).apply {
            description = "Statements, summaries, and account changes"
        },
        NotificationChannel(
            "promotions",
            "Offers & Updates",
            NotificationManager.IMPORTANCE_MIN
        ).apply {
            description = "New features, promotions, and partner offers"
        }
    )
 
    channels.forEach { manager.createNotificationChannel(it) }
}

Sensitive Data in Notifications

Financial notifications inherently contain sensitive data. A push notification that reads "You received $5,000 from John Smith" is visible on the lock screen to anyone who picks up the phone. We handle this with a two-layer approach:

Lock screen sanitization. Critical metadata is omitted from the notification preview. The lock screen shows "New transaction on your account." The full detail ("$5,000 received from John Smith") is only visible after the device is unlocked.

On iOS, this is controlled by setting .hiddenPreviewsShowTitle and configuring the notification content:

// Set notification content to hide sensitive details on lock screen
let content = UNMutableNotificationContent()
content.title = "Transaction Alert"
content.body = "You have a new transaction on your account"
content.userInfo = [
    "full_body": "You received $5,000.00 from John Smith",
    "transaction_id": "txn_abc123"
]

On Android, set lockscreenVisibility to PRIVATE and provide a public version:

val publicNotification = NotificationCompat.Builder(context, channelId)
    .setSmallIcon(R.drawable.ic_transaction)
    .setContentTitle("Transaction Alert")
    .setContentText("You have a new transaction on your account")
    .build()
 
val fullNotification = NotificationCompat.Builder(context, channelId)
    .setSmallIcon(R.drawable.ic_transaction)
    .setContentTitle("Transaction Alert")
    .setContentText("You received $5,000.00 from John Smith")
    .setVisibility(NotificationCompat.VISIBILITY_PRIVATE)
    .setPublicVersion(publicNotification)
    .build()

End-to-end payload encryption. For the highest-sensitivity notifications, we encrypt the payload on the server and decrypt it on the device. The push notification contains an encrypted blob and a generic message. The app decrypts the blob using a device-specific key stored in the secure enclave/keystore and displays the full message.

Measuring Notification Effectiveness

We track several metrics to ensure our notification strategy is healthy:

  • Opt-in rate. The percentage of active users who have push notifications enabled. Ours hovers around 85%, well above the industry average of 60% for fintech. We attribute this to our permission priming screen, which explains the value of notifications before the system prompt appears.

  • Tap-through rate by category. Fraud alerts have a 72% tap-through rate. Promotional notifications sit at 4%. This disparity is expected and healthy — it confirms that our priority tiers match user intent.

  • Disable rate after notification. We track whether a user disables notifications within 24 hours of receiving one. A spike in disables after a particular notification campaign triggers an automatic review.

  • Delivery success rate. The percentage of sent notifications that are confirmed delivered by APNs/FCM. We alert on drops below 98%, which usually indicate stale tokens that need to be cleaned up.

Conclusion

Push notifications in a fintech app are a trust contract. Every notification you send is an implicit promise: "This is worth interrupting your day for." Respect that promise by building a system that classifies, prioritizes, rate-limits, and personalizes every notification before it reaches the user. The technical implementation — APNs, FCM, channels, deep links — is table stakes. The differentiator is the decision engine that sits upstream, ensuring that every buzz of the phone reinforces rather than erodes the user's trust in your product.

Related Articles

business

Reducing Friction in Fintech User Onboarding

Strategies and technical approaches for streamlining fintech user onboarding, from identity verification and KYC to progressive profiling, while balancing regulatory compliance with conversion optimization.

11 min read
business

Layered Security Architecture for Mobile Banking

An in-depth look at the multi-layered security architecture that protects mobile banking apps, from device integrity checks and encrypted storage to runtime protection and network security.

9 min read
business

App Store Optimization for Fintech Products

A comprehensive guide to App Store Optimization (ASO) for fintech mobile apps, covering keyword strategy, creative optimization, ratings management, and the unique challenges of marketing a financial product in competitive app stores.

9 min read