Citibank e-mail phishing attempt, company says

As if e-mail spam and viruses weren’t enough to contend with on a daily basis, consumers must also continue to be wary of e-mail identity theft methods that are using trusted company names to lure victims.

Case in point: On Monday, an IT World Canada editor received an e-mail claiming to be from Citibank, a global financial services firm.

The e-mail’s subject line read “Citi: Important Message,” and stated that due to recent identity theft attempts targeting Citibank customers, the company was providing a link to its Web site where customers could “safeguard” their accounts.

“We require that you update your Citibank ATM/Debit card PIN,” the e-mail stated. “This update is requested of you as a precautionary measure against fraud. Please note that we have no particular indications that your details have been compromised in any way. This process is mandatory, and if not completed within the nearest time your account may be subject to temporary suspension.”

The e-mail contains a hot-linked URL, which opens a browser window where users can input their information. (The link produced a File 404 error message when IT World Canada attempted to open it.)

Citibank officials were unreachable at press time, but the company did confirm that the e-mail was, in fact, a scam and said it does not send e-mails requesting personal information from its clients.

According to Pete Simpson, ThreatLab Manager at e-mail filtering specialist Clearswift Ltd., banks simply aren’t doing enough to alert users to the existence of fake e-mails.

“There should be a prominent URL on bank home pages alerting users to the hoax e-mails and a dedicated helpline where users can go for advice,” he said.

Citibank appears to be following that advice. The bank offers an information page on its Web site ( where recipients of these e-mail phishing attempts can read frequently asked questions, view reported fraudulent e-mails — some dating back to December 2003 — and report the receipt of a fraudulent e-mail.

Typically trusted sources, two Canadian banks found themselves in the middle of similar phishing scams last year. Toronto-based BMO Financial Group and Montreal-based Mouvement des Caisse Desjardins said in November that hackers sent out mass e-mails hoping to target legitimate bank customers. The e-mails told consumers to click on a link to verify e-mail addresses, customer numbers, passwords and memorable data — all the information needed to access someone’s bank account.

BMO, which learned of the scam from customers, contacted the Internet service provider hosting the spoof site, which immediately shut it down. Mouvement des Caisse Desjardins tracked down an ISP in Pennsylvania and had it close the other spoofed site.

—With files from IDG News Service

Would you recommend this article?


Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.

Jim Love, Chief Content Officer, IT World Canada

Featured Download

Featured Articles

Empowering the hybrid workforce: how technology can build a better employee experience

Across the country, employees from organizations of all sizes expect flexibility...

What’s behind the best customer experience: How to make it real for your business

The best customer experience – the kind that builds businesses and...

Overcoming the obstacles to optimized operations

Network-driven optimization is a top priority for many Canadian business leaders...

Thriving amid Canada’s tech talent shortage

With today’s tight labour market, rising customer demands, fast-evolving cyber threats...

Staying protected and compliant in an evolving IT landscape

Canadian businesses have changed remarkably and quickly over the last few...

Related Tech News

Tech Jobs

Our experienced team of journalists and bloggers bring you engaging in-depth interviews, videos and content targeted to IT professionals and line-of-business executives.

Tech Companies Hiring Right Now