Citibank scams
Last updated September 19, 2026
The short answer
Citibank scams involve phishing emails about account suspensions, fake fraud alert texts, and calls from spoofed Citi phone numbers asking for verification codes. Citibank will never email you a link to verify your account, ask for your full card number by phone, or request payment in gift cards.
Citibank is one of the most commonly impersonated banks in phishing emails worldwide. Scammers send highly convincing emails that replicate Citi's branding, including logos, colors, and formatting. These phishing campaigns often target Citi credit card holders with fake alerts about suspicious activity or account restrictions.
How Citibank scams work
- 1
Phishing email about account restriction
You receive an email that looks like it's from Citibank saying your account has been restricted or your card was used for a suspicious transaction. The email includes a link to "verify your identity" or "review the transaction."
- 2
Fake Citi login page captures credentials
Clicking the link takes you to a fake Citibank login page that looks identical to the real one. You enter your username, password, and security questions, all of which are captured by the scammer.
- 3
Follow-up call for additional info
After capturing your login, the scammer calls pretending to be Citi's fraud department. They ask for additional verification like your full card number, CVV, or the one-time passcode sent to your phone.
- 4
Unauthorized charges and account takeover
With your credentials and card details, the scammer makes purchases, sets up new payees, or transfers money from your account.
Warning signs
- An email from "Citibank" asks you to click a link to verify your account
- The email creates urgency, like "Your account will be closed in 24 hours"
- A caller claiming to be Citi asks for your CVV or full card number
- You're asked to share a one-time passcode to "confirm your identity"
- The email sender address doesn't end in @citi.com or @citibank.com
- A text about a Citi transaction includes a link to click
Examples
Citi account suspension phishing
An email with Citibank's logo says your account has been suspended due to unusual activity. It says you have 24 hours to verify your identity or your account will be permanently closed. The "Verify Now" button goes to a fake site that captures your login credentials, Social Security number, and card details.
Fake Citi fraud department call
After clicking a phishing link days earlier, you receive a call from someone claiming to be Citibank's fraud team. They reference a "suspicious login" on your account and ask you to confirm a code sent to your phone. The code authorizes adding the scammer's device to your account.
What to do
- Don't click links in Citibank emails. Log in directly at citibankonline.com or through the Citi app.
- Call Citi directly at the number on the back of your card if you receive a suspicious alert.
- If you entered credentials on a fake site, change your Citibank password immediately.
- Report the phishing email by forwarding it to spoof@citi.com.
- Review your recent transactions and report any unauthorized charges to Citi.
Report it to Citibank
Forward suspicious email to spoof@citi.com and call the number on the back of your card.
Getting your money back
If your Citibank account was compromised, call the number on the back of your card immediately. Citi's fraud protection covers unauthorized charges on credit cards, and your maximum liability is $0 for unauthorized transactions reported promptly. For debit cards, report within 2 business days for the strongest protection under Regulation E.
Frequently asked questions
Does Citibank send emails about account problems?
Citibank may send account alerts, but they will never send an email asking you to click a link to verify your identity, provide your full card number, or share your password. Legitimate Citi emails direct you to log into your account through the app or website.
How do I report a phishing email pretending to be Citibank?
Forward the email to spoof@citi.com without clicking any links. You can also report it to the FTC at ReportFraud.ftc.gov and the Anti-Phishing Working Group at reportphishing@apwg.org.
Am I liable for unauthorized charges on my Citi card?
For credit cards, Citibank's $0 liability guarantee means you won't be held responsible for unauthorized charges reported promptly. For debit cards, federal law limits your liability to $50 if reported within 2 business days, but it can increase the longer you wait.
Other companies scammers impersonate
Scams reuse their scripts across brands. If you were contacted about Citibank, these are the guides worth reading next.