• Your security is governed by your Unique Secure IPIN (Internet Password).
• To select your IPIN online, you will have to verify your personal information and generate an Online Authorisation Code (OAC) that will be sent to your Mobile phone/E-mail address. You will then have to reconfirm the details and select your IPIN.

When creating a Password, make sure…

• The IPIN is a combination of a minimum of eight characters consisting both alphabets and numerals. We strongly recommend that you alter your IPIN at regular intervals with your own combination so that nobody but yourself knows what your password is.
• Make sure the password is complicated enough for anybody to even guess the password.

Protecting you and providing a secure environment is a top priority for Citibank. Some of the measures are:

Secured login

• All information passed on between Citibank and your personal computer is "scrambled" and "reassembled" using 128-bit encryption, the highest level of encryption commercially available.
• You can access your account by using only the Citibank-issued Card number and PIN/password. You have to enter the Internet Password (IPIN) every time you login to Citibank Online.

Automatic time out

• Once logged in to Citibank Online, if there is no activity for 5 minutes, your secured Citibank Online session will be automatically terminated to help protect against unauthorised access.

Automatic lock out

• If the Internet Password (IPIN) has been entered incorrectly six consecutive times, Citibank will lock any further online access to the accounts.
• If you have been locked out of your accounts due to incorrect PIN/password entry, contact your local Citibank Customer Service Officer.

• Digital Certificates provide you the evidence of the server's authenticity which safeguards users from trusting unauthorised sites and allows the session to be encrypted.
• This is provided by a third party, the Certification Authority, which in this case is VeriSign.
• You will see a 'closed lock' icon at the bottom of the Internet Banking screen.
• Clicking on the lock will allow you to see the VeriSign Certificate authenticating the site.
• While we have gone to extraordinary lengths to make sure your online transactions are secure, you could also do a few things to ensure the security of your transactions.

General Security

Some of the most effective things you can do to protect yourself are simple to do. Here are some steps you should take:

• Keep your Internet Password (IPIN) confidential.
• Use a secure password, which cannot be easily guessed. Do not use commonly used passwords like your vehicle registration number, birthdays, etc.
• Log off from Citibank Online after you complete your transactions every time. Do not just close your browser.
• Avoid accessing Citibank Online from a public/shared computer.
• Login regularly to monitor your transactions.
• Never fill an E-mail with input fields that ask you for sensitive data such as User ID, Passwords, PINs, ATM and Account Number Information.
• Look for the padlock symbol on the bottom bar of the browser to ensure that the site is running in secure mode before you enter sensitive information.
• Please bookmark/add to your favourites the following URL to access information and transact on your account with Citibank www.citibank.com/india.

Browser Security

Although Internet browsers have built-in security, small Internet files are downloaded to your computer whenever you are online. Some of the files may pose a security risk. Enhance your security by taking some of the following actions:

• Clear your browser's cache and history after each session so that your account information is removed, especially if you are using a shared computer.
• Use an Internet browser that supports 128-bit encryption.
• If you use Internet Explorer, configure the browser not to remember passwords (disable AutoComplete)

	To disable the "AutoComplete" function
	1.	Launch your Internet Explorer and click on "Tools" >> "Internet Options" >> "Content"
	2.	Under "Personal Information", click on "AutoComplete"
	3.	Uncheck "User names and passwords on forms" and click on "Clear Passwords".
	4.	Click "OK"

Navigate Safely

Navigate the Internet safely to reduce the likelihood of online fraud. Avoid fraudulent websites:

• To ensure that you are going to an authentic Citibank site, type in the entire Citibank website address into your browser instead of clicking on the link directly. For this, you would have to type in "http://www.citibank.com/india" into the browser address field.
• Beware of pop-up windows that ask for your account number and PIN (Personal Identification Number). Citibank Login pages are always on a web page and never in a pop-up window.
• If you suspect a website is fraudulent, leave the site. Do not follow any of the instructions it may present to you.
• Citibank will ask you to fill any account details only on either www.citibank.com/india or any Citibank URL starting with www.online.citibank.co.in.

Online Identity Fraud also known as "Phishing" occurs when fraudsters pose as trusted organisations and send out thousands of fraudulent E-mails to random E-mail addresses.

How can you tell the difference between a genuine Citibank E-mail and fraudulent one?

• Citigroup frequently communicates with its clients via E-mail. The majority of these communications are to provide you with information and updates about our services.
• All E-mails from Citibank carry the last 4-digits of your Card/account number at the top of the
  E-mail. This is intended to assure you that these mails have indeed originated from Citibank.
• Citibank will never send you an E-mail requesting confidential account information. Delete such E-mail even if they appear to have come from Citibank.
• Fraudulent E-mails usually contain a link to a look-alike website to mislead you into entering sensitive financial information such as your account number and Internet Password (Internet Password (IPIN)). This will enable the fraudsters to capture your account information to access your bank accounts. Citibank will ask you to fill any account details only on either www.citibank.com/india or any Citibank URL starting with www.online.citibank.co.in.
• If the link from an E-mail goes to a login page or a pop-up window, do not enter your account number and PIN. Always type in the entire website address www.citibank.com/india to access Citibank Online.
• Citibank will never send you urgent or time-sensitive E-mails that ask you to provide, update or confirm sensitive data like your Citibank Card number or Internet Password (IPIN), APIN, TPIN or expiration date, etc.
• Check the sender E-mail address to verify that it is from a valid E-mail account. Never open E-mail attachments from sources that you cannot trust.
• Always scan E-mail attachments for viruses before opening them. If you are unsure about the source of an attachment, delete it.
• Be alert for scam E-mails. These are designed to trick you into downloading a virus or jumping to a fraudulent website and disclosing sensitive information.

What you should do in case of E-mail or phishing threats:

• If you suspect you have been sent a fraudulent E-mail, contact your local CitiPhone Officer immediately or send a secure mail once you have signed on to Internet Banking.