Citibank Email Hoax and web page scam
18th November 2003 & Extended Warnings through to Jan. '04.

Citibank users beware, this is a very convincing email scam emanating from Russian web space...

This Citibank Email verification hoax was first reported to us in November 2003. The email is being distributed in text only format so be aware that it may look slightly different if you receive it, depending on your email program settings (see image below).

This hoax email scam is pretty much the same as that which hit British banks during October and November (see Bank hoax email scam).

The email asks that you verify your email address, it is not made particularly clear why, except that it goes on to suggest that it is for your own protection and some members may not have access to their email account any more. It goes on to provide a link for you to do just that.

The link is partially cloaked (disguised), with the first part of it showing as 'http://www.citibank.com.....', but this not a true indication of where it will take you. The link points to a web page hosted in Russia, but that page is scripted to open two windows. The first window brings up the genuine Citibank.com home page, and a smaller 'pop up' window is also opened and presented directly in front of the Citibank page. The small 'pop up' window is where you are given a short 'form' to complete and it is that which captures the data entered and relays it to the scammers. This small pop up window is the fake component, but when presented to a Citibank user with the genuine home page as a back drop, it gives the illusion that you really are dealing with Citibank themselves (see images below).

We have received further reports of this email scam during December '03 and January 2004, but with different links. So, please be aware that the link text in the email may differ as will the destination page of any of those links. This included a link to www.citibanksecure.us which is not connected with Citibank at all, but is just another means to convince you that the email is genuine.

If you supply that information in the form, and then submit it, the information will be captured utilising PHP script while the pop up window page changes to a confirmation that your information has been received.

If you have received this hoax email, please remember that it is very common for these email scams to be redistributed at a later date with only slightly different content or the same but with the fake page(s) hosted by a different provider. Also, once you have received one of these hoaxes, it is also common place to receive at least another one and usually a day or two after the first, although not necessarily from the same apparent sender.

Take a good look at the following images, because this hoax email scam may be coming to an inbox near you!

The fake web pages...