Security Centre

Protect Yourself from Fraud

Here are few types of fraud and the preventive steps that you can take to prevent yourself from becoming a victim.

Impersonation Scam

Impersonation scams are calls from people claiming to be government officials or staff members of any agency asking for personal details. Callers may claim your identity was used for suspicious activity and may intimidate you into giving them personal information such as your passport, bank account number, internet banking credentials or One-Time PIN (OTP).

How to protect yourself against impersonation scams:

Do not follow the caller’s instructions, including allowing remote access to your electronic or mobile devices. In some cases, scammers may threaten you not to talk to anyone about your situation so that you are unable to verify if it is a scam.	Do not disclose your banking or card credentials and One-Time PIN (OTP), and do not lend your ATM/ Credit Card/ Hardware Token to anyone.
Read carefully the content of any OTP received and never disclose your OTP to anyone over the phone or to unfamiliar websites.	Always review any SMS or email notifications from Citibank relating to your account and report any unauthorised transactions to Citibank immediately.

Phishing

Phishing emails, also known as hoax or spoof emails, are fraudulent emails that appear to be sent from a trusted source but are in fact, designed to trick you into revealing valuable data such as your User ID, password, card details and
One-Time Pin (OTP).

You have an important role to play to ensure that you and your account(s) are protected while banking with us electronically. Here are some useful tips:

Your Role and Responsibility

The E-Payments User Protection Guidelines (the “Guidelines”) issued by the Monetary Authority of Singapore (“MAS”) set out the expectations of MAS of any responsible financial institution that issues or operates a protected account. The Guidelines also cover duties of account holders and account users of protected accounts, and provide guidance on the liability for losses arising from unauthorised and erroneous transactions.

Some important definitions in the Guidelines include:

• (1) a "payment account" as:
  • (a) any account, or any device or facility (whether in physical or electronic form), that —
  • (i) is held in the name, or associated with the unique identifier, of any person, and is used by that person for the initiation of a payment order or the execution of a payment transaction, or both; or
  • (ii) is held in the names, or associated with the unique identifiers, of 2 or more persons, and is used by any of those persons for the initiation of a payment order or the execution of a payment transaction, or both; and
  • (b) an account which includes a bank account, debit card, credit card or charge card.
• (2) a “payment transaction” as the placing, transfer or withdrawal of money, whether for the purpose of paying for goods or services or for any other purpose, and regardless of whether the intended recipient of the money is entitled to the money, where the placing, transfer or withdrawal of money is initiated through electronic means and where the money is received through electronic means.


• (3) a “protected account” as any payment account that:
  • (a)is held in the name of one or more persons, all of whom are either individuals or sole proprietors;
  • (b) is capable of having a balance of more than S$1,000 (or equivalent amount expressed in any other currency) at any one time, or is a credit facility;
  • (c) is capable of being used for electronic payment transactions; and
  • (d) where issued by a relevant payment service provider is a payment account that stores specified e-money.
• (4) an "unauthorised transaction" (in relation to any protected account) as any payment transaction initiated by any person without the actual or imputed knowledge and implied or express consent of an account user of the protected account. This includes “seemingly authorised transactions” as defined in the Guidelines to the Shared Responsibility Framework.
  
  The following are examples of payment transactions that do not fall within the scope of unauthorised transactions:
  • (a) The account user knew of and intended to make the payment transaction, notwithstanding that the transaction could have arisen as a result of falling victim to a scam (e.g., e-commerce, government-official impersonation, job, investment or love scams);
  • (b) The transaction was performed by a person as a result of the account holder sharing access and usage of their devices with the person, or storing the person’s biometrics identities on their devices. The account holder is deemed to have consented to the use of his account by this person.
• (5) the “transaction notification threshold” means—
  • (a) the threshold for transaction alerts set by the account holder; or
  • (b) if the account holder did not set any threshold for transaction alerts, the default industry-baseline transaction notification threshold.

In accordance with the Guidelines, Citibank would like our customers and account users of protected accounts to take note of (a) their duties set out in section 3 of the Guidelines, and (b) Citibank’s duties set out in section 4 (excluding paragraph 4.3) of the Guidelines. You should note that except for paragraphs 4.2 to 4.6, 4.10 to 4.12 and 4.14 to 4.16, section 4 of the Guidelines do not apply to Citibank in respect of any credit card, charge card or and debit card issued by Citibank. Please carefully review the Guidelines here.

We would like to draw your attention to para 3 of the Guidelines which provides for the customer/account user’s duties. Some of these duties are highlighted below. These are not intended to be exhaustive and you should refer to the Guidelines (link above) for further details on customer/account user’s duties.

(a) Provide contact information, opt to receive all outgoing transaction notifications and monitor notifications. It is your responsibility to provide us with complete and accurate contact information in order for us to send you notification alerts for transactions, activation of digital security token and the conduct of high-risk activities. You are also responsible to (i) enable notification alerts via SMS, email or in-app/push notification (i.e. Citi Alerts) on any device (used to receive transaction notifications from Citibank); (ii) opt to receive notification alerts for all outgoing transactions of (any amount that is above the transaction notification threshold) made from your protected account, activation of digital security token and the conduct of high-risk activities made from your protected account, and (iii) monitor the transaction notifications sent to you or the designated account contact. (For this reason, Citibank will assume that you will monitor such notification alerts without further reminders or repeat notifications.)

If you wish to update your transaction notification threshold and preferred mode of notification for outgoing transaction alerts, please log in to the Citi Mobile^® App and select “Manage alert preferences”. For International Personal Bank Singapore customers, you can log in to Citibank Online and navigate to 'Manage Alerts' under 'My Profile'.

(b) Protect your access codes. You should protect the access codes that you use to authenticate any payment transaction or your identity (e.g. your password or OTP) and not voluntarily disclose these to any third party, including the staff of Citibank. You should not keep a record of any access code in a way that allows any third party to easily misuse the access code.

(c) Secure access to your protected account. You should only download our Citi Mobile App from official sources. You should ensure that you have strong passwords and install and maintain your device with the latest anti-virus software. You should not root or jailbreak your device nor download and install applications from third-party websites outside official sources (“sideload apps”), in particular, unverified applications which request device permissions that are unrelated to their intended functionalities.

(d) Read content sent with access codes. You should read the content of the messages containing the access codes and verify that the stated recipient or activity is intended prior to completing transactions or high-risk activities.

(e) Obtain Citibank’s website addresses and phone numbers from official sources and contact Citibank using contact details from official sources. You should refer to official sources (for example the MAS Financial Institutions Directory, the Citi Mobile App or the back of your Citibank-issued credit card or debit card) to obtain our website addresses and phone numbers.

(f) You should not click on links or scan QR codes. You should not click on links or scan QR codes purportedly sent by Citibank unless you are expecting to receive information on Citibank products and services via these links or QR codes. Citibank will not send you links or QR codes which directly result you in providing us any access code or to make a payment transaction or high-risk activity.

(g) You should understand the risks and implications of performing high-risk activities. Before performing any high-risk activities, you should read Citibank’s risk warning message and ensure you understand the risks and implications of proceeding. By proceeding, you are deemed to have understood the risks and implications as presented by Citibank.

(h) You should report unauthorised activities on your protected account and provide the required information to Citibank. You should report any unauthorised activity on your protected account to Citibank as soon as practicable, and no later than 30 calendar days after receipt of any transaction notification alert for any unauthorised activity. In connection with your report, you should provide us with any of the information as set out in section 3.18 of the Guidelines upon our request within a reasonable time.

(i) You should activate the Citibank Kill Switch. If you are notified of any unauthorized transactions and have reason to believe that your account has been compromised or if you are unable to contact Citibank, you should activate the Citibank Kill Switch available on the Citi Mobile App, as soon as practicable, to block further mobile and online access to your protected account. Please refer to https://www.citibank.com.sg/personal-banking/online-services/kill-switch for more details.

(j) You should make a police report if you suspect you are a victim of scam or fraud. Citi requires you to provide a police report to facilitate our claims investigation process. You should fully cooperate with the Police and provide evidence (such as furnishing your mobile device to the Police for forensics investigation).

An account user would be responsible for actual loss arising from an unauthorised transaction if such account user’s recklessness was the primary cause of loss. Recklessness would include the situation where the account user deliberately did not comply with the duties set out in section 3 of the Guidelines, which includes the duty to enable transaction alerts. It is therefore important for you to read and understand your duties under section 3 of the Guidelines and to understand that the preferences you set for transaction alerts (including how low or high your selected threshold amount is, and the types of transactions for which you elect to receive notifications) would affect how the liability framework in section 5 of the Guidelines would be applied and how any claim by you in relation to an unauthorised transaction would be resolved.

As set out in the Guidelines, examples of conduct that constitute recklessness and could lead to losses from unauthorised transactions include:

• • (a) storing access code in a manner that can be easily accessed by any third party;
  • (b) knowingly sharing or surrendering access codes to non-account users, resulting in completed transactions;
  • (c) ignoring notifications, alerts or warnings from the responsible FI;
  • (d) following instructions of third parties to open new bank or card accounts without a reasonable basis;
  • (e) retaining sideloaded apps which are unverified or request device permissions that are unrelated to their intended functionalities; and
  • (f) selecting a numeric or alphabetical access code that is easily recognisable, such as one which represents their birth date, or part of their name, if the responsible FI has:
  • • specifically instructed the account holder not to do so, and
  • • warned the account holder of the consequences of doing so.

Liability Framework for Unauthorised Transactions under the Guidelines

The Guidelines set out in section 5, a liability framework relating to unauthorized transactions effected on a protected account. For the avoidance of doubt, the section 5 liability framework does not apply in respect of any Citibank credit card, charge card or debit card (please refer to the relevant cardholder agreements for the terms regarding liability).

Further, Customers should note that the Guidelines provide that “where any account user knew of and consent to a transaction (“authorised transaction”), such a transaction is not an unauthorised transaction, notwithstanding that the account holder may not have consent to the transaction.

The information set out below has been distilled from section 5 of the Guidelines and is not intended to be exhaustive. Customers are advised to read the Guidelines for full details.

Scenario (1): Customer is liable for actual loss

The customer will be liable for the actual loss arising from an unauthorized transaction on a protected account if the customer/account user’s recklessness was the primary cause of the loss. Recklessness would include the situation where any account user deliberately did not comply with section 3 of the Guidelines. Please also refer to the above examples of conduct that constitute recklessness.

Scenario (2): Customer is not liable for any loss

The customer is not liable for any loss arising from an unauthorized transaction if the loss arises from any action or omission by Citibank and does not arise from any failure by any account user to comply with any duty in section 3 of the Guidelines.

Any action or omission by Citibank includes the following:

• (a) fraud or negligence by Citibank, its employee, its agent or any outsourcing service provider contracted by Citibank to provide Citibank's services through the protected account;


• (b) non-compliance by Citibank or its employee with any requirement imposed by MAS on Citibank in respect of its provision of any financial service; and


• (c) non-compliance by Citibank with any duty set out in section 4 of the Guidelines.

Scenario (3): Loss resulting from any action or omission of any independent third party

The customer is not liable for the first S$1,000 of loss arising from an unauthorised transaction, if the loss arises from any action or omission by any third party not referred to in scenario (2) above, and does not arise from any failure by any account user to comply with any duty in section 3 of the Guidelines.

Last updated: 16 December 2024

Other Advisory

Always make sure that you have entered your User ID and Password and other confidential information in the legitimate Citibank Website by entering Citibank's Website address https://www.citibank.com.sg or https://www.citigold.com.sg directly onto your Web browser.

We're constantly updating and improving our wide variety of security measures, providing you the confidence you need when using Citi Mobile or Citibank Online.

Web Security

• Our 128-bit SSL (Secure Sockets Layer) encryption engine provides industry standard levels of security, ensuring your information can't be accessed by anyone else.

  
• The green address bar on Citi websites indicates that the site has undergone extensive vetting by our security teams and has been granted a security certificate known as an Extended Validation SSL Certificate.
• For safety, we’ll suspend your online access if three failed login attempts are made. We’ll also block access to cash machines if the wrong PIN is entered three times.
• You are recommended to use supported and updated browsers to ensure your internet banking is secured at all times. Learn More
• Every time you sign in to Citibank Online, the date and time of your last visit are shown. If you didn't sign in then, this will indicate an unauthorised account access has occurred.

2-way SMS Notification

• Our 2-Way SMS service alerts you of any suspicious transactions on your account. It is important that you respond to us immediately:
  • You should reply to the SMS with "1" if the transaction is authorised by you or "2" if the transaction is not authorised by you.
• Please note
  • You will receive the SMS from the number 72484 ("Short Code") if your registered mobile is a Singapore number and +65 9657 2484
    ("Long Code") if your registered number is not a Singapore number*.
  • We will not ask for any additional information to be provided other than "1" or "2".
  • If you are overseas or holding onto an overseas mobile number, please send your reply to +65 9657 2484.
  • Please contact the Fraud Hotline +6563375519 if you have any issues.
• You can stay on top of your account activities with customised Citi Alerts, where you can get SMS or email notifications whenever there is a specific transaction on your account. Learn More

Citi Mobile^® Token

• Citi Mobile^® Token is a feature within the Citi Mobile^® App that authenticates transactions as an alternative to other authentication methods such as Online Security Device, or One-Time PIN (OTP) via SMS.

• The benefits of Citi Mobile Token are:

  

  SECURE

  Protected by a 6-digit Unlock Code chosen by you and restricted to one device of your choice.

  

  INSTANT

  Enter your unique Unlock Code to instantly authenticate your transactions initiated in Citi Mobile^® App on your Citi Mobile^® Token enabled device. No more waiting for an OTP via SMS, or worrying about misplacing your Online Security device.

  

  EASY

  Authenticates all online transactions such as payments and transfers, adding new payee and updating your contact details. It also generates OTP for online purchases.

• With the Citi Mobile^® Token, you can instantly authenticate all transactions initiated in the Citi Mobile^® App. You can also instantly generate OTP with your unique Unlock Code to authenticate transactions on Citibank Online or for online purchases. To learn more, click here
• After enrolling to Citi Mobile^® Token, you should not share or reveal your Unlock Code to anyone, including Citibank.

Misplaced your card? Lock your card on the Citi Mobile^® App

• If you’ve misplaced your card, you can temporarily lock your card at Citi Mobile^® App so that no one else can use it. You can unlock your card just as easily when you need to.
• While your card is locked, you will not be able to use it for point-of-sale transactions. However, any recurring payment instructions that you may have established on your card will not be affected.
• To terminate your card and request for a replacement if your card is lost or stolen, please call our Citiphone hotline.

If you suspect there are unauthorised transactions on your account or you wish to report suspicious emails, SMS messages or phishing websites:

Step 1

Call

• CitiPhone banking: (65) 6225-5225
• Commercial Bank hotline: (65) 6238 8833

Email: spoof@citicorp.com.

Step 2

Change your Citibank Online User ID, Password and ATM PIN immediately.