At Citi, security for our clients is our utmost concern. As hackers and others, such as organized criminals, continue to try to get unauthorized access to funds, we would like to highlight some typologies and best practices for you to consider in helping to make sure your organization remains secure.

 

Types of fraud and cyber-attacks:

Business Email Compromise and Payment Redirection
In this scenario, a fraudster e-mails a company's finance team, impersonating a supplier, creditor, or an executive. The e-mail might appear to be from senior management, requesting a payment be made, or from a supplier, requesting that payments go to a new account. Fraudsters will use a hacked or look-alike email that closely matches a known address to ensure this type of fraud is difficult to detect.

How to help keep your business safe:

Phishing, Smishing, and Vishing
Fraudsters use the following techniques, commonly referred to as “Social Engineering”, to obtain information:

Phishing: Emails that lure potential victims to click on malicious links, or open malicious attachments which can serve as the delivery platform for malware such as a Ransomware attack.

Vishing (telephone scams): A form of fraud using social engineering to impersonate trusted officials over the phone or via text message. One example of vishing is criminals impersonating bank staff by phone and requesting the victim’s online banking login details and passcodes to address a fictional ‘security or fraud incident’. The details provided by the victim are used to execute fraudulent payments.

Smishing (SMS text scams): Text messages may claim that your bank suspects there has been fraudulent activity on your account, you may have won a prize or even have issues with the local authorities.

Best practices to help your organization stay safe from social engineering:

Malware
Malware can be downloaded under various circumstances, such as when visiting a malicious or vulnerable website, viewing an email message or by clicking on a deceptive pop-up window. Malware is malicious software installed on your computer which has a harmful intent that can, among other things, capture your login passwords and other personal data. Examples of malware include software such as spyware, adware, and viruses. One way to help protect your organization from Malware is to exercise caution before installing programs on your computer or opening email attachments.

Here are some precautions that are important to take:

Additionally, you should engage your organization’s IT department to assist with the PC best practices and perform related risk assessment along with controls evaluation periodically.

Please contact your Citi Representative immediately if you notice suspicious account activity or experience information security-related events.

 

CitiDirect^® Best Practices

To help maintain a high level of security, please ensure that you regularly review your controls and follow the below best practices:

For assistance with implementing the above best practices, please utilize the Client Service Academy training or contact your Citi service representative.

Physical Token Users (SafeWord card or VASCO token)

Never share your physical token
Physical tokens should never be shared. Sharing a physical token increases the risk of fraud. Because you have agreed to keep your physical token secure, any transaction that utilizes that token will be attributable to you.

Keep your PIN secret
Similarly, it is very important to keep your PIN secret. Your PIN is your first line of defense against someone using your physical token to input or authorize a transaction in your name. Treat your PIN the same as you would your own ing card PIN and do not store the PIN in a visible location such as the sleeve of the card. Never write down the PIN.

The PIN on your physical token can be changed and Citi recommends that users change PINs periodically.

Note: Please ensure that you remember the new PIN that you enter in Step 4 below as this PIN will be known only to you. If you forget your new PIN Citi cannot reset it; the physical token will be unusable and you will need to contact Citi to have a new token issued to you.

To change your SafeWord card PIN:
(Press [Clr] at any time in the process to cancel)

To change your VASCO token PIN:

IMPORTANT: Citi will not on an unsolicited basis request users to provide their electronic banking credentials such as PINs, passwords or any other such security information.

 

CitiDirect Mobile App Users

Keep your device secure
Make sure to keep your operating system and CitiDirect mobile app up-to-date. Ensure that your device is protected with a strong password/PIN/pattern and enable biometrics where available.

Biometric login
Where available, enable biometrics on the CitiDirect Mobile App. When you log in with biometrics to CitiDirect on your computer, you will see a code on the computer screen and on your device. Ensure these codes match before you authenticate.

 

User Management

Delete former employees' user accounts
Ensure that when employees leave or transfer to other roles their user accounts are deleted from the system and that their credentials are revoked. It is important that physical tokens are not reassigned to new users. Also note that users' access can be scheduled automatically to expire on a future date to ensure credentials are not used inappropriately.

Entitlement reviews
Perform regular user entitlement reviews on the system to ensure access is appropriate and current. Ensure the CitiDirect user has received their credentials prior to enabling* on the system. Users who are “out of office” for extended periods (e.g. vacations, extended leave, etc.) should be disabled* until they return to the office.

* Security Managers can enable or disable a user by checking or unchecking the “Enable” check box on the user's profile. Refer to the Security Manager Guide for more information.

 

This information and materials linked herein are provided for educational and illustrative purposes only and not as a solicitation by Citi for any particular product or service. Citi reminds you that Citi's clients are responsible for their organizations' cybersecurity and all matters relating thereto. This information and materials linked herein should not be viewed as any intention or commitment from Citi to replace your organization's cybersecurity-related responsibilities. Furthermore, although the information contained herein is believed to be reliable, the information does not constitute legal advice and Citi makes no representation or warranty as to the accuracy or completeness of any information contained herein or otherwise provided by it.

 

▶  Go to Login Page