Protect yourself from scams

Young woman sitting outside with her phone

Latest security alert

Scams continue to be on the rise and we've identified a few scam types that are more likely to impact you.

1. Impersonation scams

Scammers pretending to be from reputable organisations can contact you and use different tactics to get you to share your personal information, including your account information. For example, you may get a call, email or SMS that appears to come from us, another bank, or legitimate business, like a telephone or internet service provider, claiming that you need to confirm your identity or provide your One-Time PIN to continue managing your account online. If you get an SMS from us with a code to authorise a transaction, please ensure you read the whole SMS carefully as it might be shortened when it pops up on your screen.

2. Investment scams

Investment scams target your personal wealth by convincing you to invest in fake schemes and companies. They are widespread and can take many different forms. Look out for these warning signs to identify investment fraud:

Promise of low risks with high returns: Always remember, if something seems too good to be true, it probably is.
If you are promised ‘guaranteed returns’ this may be a warning sign.
High-pressure tactics: You are contacted repeatedly and are told that you need to act quickly and invest or you will miss out.
Someone you haven’t met in person offers you investment advice: never take investment advice from someone you meet on the phone, via email or any social media apps.
Someone has convincing promotional materials or websites: If documents like prospectuses aren’t registered with ASIC, it is likely part of a scam. Always call us on 13 24 84 (or +61 2 8225 0615 if calling from overseas) to verify the legitimacy of any promotion being offered to you.
You are asked to deposit funds into different accounts for each transaction: Scammers may claim this is for security reasons, or because they are an international company.

3. Goods not received scams

Scammers can also contact you via email or social media and advertise attractive sales or deals that link to a fraudulent website where you can make a purchase.

For example, you may get Facebook or other type of social offers for seemingly great bargains, but after making a payment you won't receive the item and you may get charged more than what was advertised.

4. Remote access scams

Scammers may call and alert you to a 'virus' or 'issue' with your computer or account and request remote access to your computer to fix it. Never agree or provide anyone access to your computer. If you receive an unexpected phone call, text or email about your computer and remote access from someone claiming to be from a company or business you recognise, hang up or delete the message immediately.

What you can do to protect yourself

1. Recognise suspicious communications

Learn to recognise suspicious communications, even if they appear to be coming from us. Please read all messages carefully. We'll never pressure you to transfer funds or request your personal details, account details, your One-Time PIN or your password via email, SMS or phone. If unsure, call us using the verified numbers mentioned on our website.

2. Pause before you pay

Be mindful of retail websites and online or social media offers that are fake but appear genuine. Scammers always use a website that appears legitimate and request your account details and/or One-Time PIN to make a purchase or further transactions on your account.

3. Check before you share

Never share your password, your One-Time PIN, or any other Online Activation Codes with anyone, even with us. If you give out your One-Time PIN or receive an SMS from Citi AU advising your card has been added to a mobile wallet without your request, please call us immediately. Update your password regularly and make sure your contact details are correct so we can contact you about any potential scams.

4. Think before you click

Avoid clicking on suspicious links or downloading attachments from unknown sources. Scammers often use links or attachments to install malware or obtain your personal information.

See previous security alerts
February 2023 – Unsolicited contacts about investing

Be aware that scammers are impersonating Citi via phone calls and emails. Actual Citi employee names and details are being used to increase legitimacy of these offers.

We will never offer you investment bond opportunities and ask you to transfer money to another account straight away. We will also never send you a link asking you to sign into Citi Online or provide any of your personal or banking information. When speaking with us, always call us using the verified numbers mentioned on our website.

September 2022 - Optus customer cyber attack

There is no impact to our systems as a result of the cyber-attack that resulted in the release of Optus customer's personal information. Our security controls are in place and working effectively. The security team are closely monitoring the situation and customers should not be concerned about their accounts.

For Citi branded customers that hold an account with Optus, we advise contacting them for instructions about actions that need to be taken or should you have any concerns. This can be done via the My Optus App or by calling 133 937.

In addition to the actions our security team are taking, we recommend Optus customers monitor their accounts for any unusual activity and contact us immediately if there are any concerns by calling 13 24 84.

September 2022 - Investment scam alert

Please be aware that customers are currently being targeted with investment scams, with some scammers impersonating our employees via email, from addresses that appear legitimate like 's.driscoll@citi.gold-wealth.com'. Please be aware that genuine emails about investments will come from either your Relationship Manager (if you have one) or our Sky Banking team and follow the format 'firstname.lastname@citi.com'.

If you're unsure whether an email you've received is genuine, please do not respond. Contact your Relationship Manager directly if you have one, or call us on 1300 550 216.

Scammers may also attempt to imitate employees or create false employee personas using social media, including LinkedIn, for fraudulent profiles.

You can find more information on the Scamwatch website.

Security alert: DYRE malware

Variants of the DYRE malware continue to target customers worldwide.

DYRE, also known as Dryeza, is a malicious program used by cybercriminals to steal log-in credentials and perform fraudulent transactions. DYRE is usually spread by phishing emails containing attachments or hyperlinks that, once opened, can exploit your computer's existing security flaws to install the malware. Once installed, DYRE can redirect websites through servers operated by criminals, allowing them to capture and alter data in real-time.

Signs of a DYRE infection include:

Repeated request for User ID, Password and/or One-Time PIN (OTP)

Changes in the appearance or procedures of Citi Online

Delays and persistent "loading" screens.

We recommend customers remain alert for malware threats and review our Online Security Tips.

Customers who notice unusual behaviour in their Citi Online account or believe their computer may be infected should immediately contact the Customer Service Team on 13 24 84 or +61 2 8225 0615 if you are overseas.

Report fraud or a scam

Reporting scams

If you believe you have been the victim of a scam, please contact us immediately on 1300 550 216.

It’s important that you get in touch with us if:

you’ve sent money or authorised a payment due to a suspected scam
you’ve provided your identity information and/or account details to someone who you believe is a scammer
you’ve found unauthorised transactions in your account statements

Report any scams to Scamwatch

Report any scams to Scamwatch, an independent website run by the Australian Competition & Consumer Commission (ACCC).

Scamwatch provides information to consumers and small businesses on how to recognise, avoid and report scams. Anything reported to Scamwatch will be analysed and acted on by the ACCC.

Actions you can take immediately

Block your card
If your card is missing or you are concerned about fraudulent activity, you can block your card via the Citi Mobile^® App, Citi Online or by calling us.

Citi Mobile^® App

Log in to the Citi Mobile^® App

Tap the 'Profile & Settings' icon on the top left of your app home screen.

Select 'Lock / Unlock card' under 'Cards'.

Select the card you want to lock.

Tap 'Lock card' and follow the prompts.

Citi Online

Log in to your Citi Online account

Click on ‘Services’ from the top navigation

Select ‘My Profile’ from the dropdown menu

Select ‘My Profile’ again from the menu on the left

Select ‘Card Activation’ and follow the prompts to deactivate.

Customer Service Centre

Contact us to report a lost or stolen card immediately on 13 24 84 (or +61 2 8225 0615 if calling from overseas). We will review your recent transactions, block your account to stop any fraudulent activity and arrange for a new card to be sent to you.
Report suspicious emails
Change your password
Report or dispute unusual transactions

If you see an unusual transaction you don’t recognise, you can search the internet for the company name or ABN. Some businesses use different company names when billing customers to their physical or online stores. If you still don’t recognise the business name, give us a call.

If you recognise the transaction but something is not right (i.e you haven’t received the item you ordered, or the wrong item has been delivered) please submit a transaction dispute online.

We also have a number of measures to keep your account safe

The Citi One-Time PIN (OTP)

The Citi One-Time PIN (OTP) adds to the security of your account when you are transacting online. All major transactions, including adding a payee will require an OTP to be completed. You can receive an OTP as an SMS or generate one using the Mobile OTP function on the Citi Mobile^® App. Find out more about Citi One-Time PIN.

Please note, we will never ask you to share your OTP or any other code or password. If someone claiming to represent Citi asks you for this information, please do not provide it and report it as a potential scam to Scamwatch.
The Online Authorisation Code (OAC)
Our Two-Way Alert service

Our Two-Way Alert service has been designed to help you keep your credit and debit purchases safe. It ensures a quick and easy two-way communication with us in the event of any suspicious activity being detected when making a purchase.

The Two-Way SMS and email alert service is set up for all Citi credit and debit card holders. The service will immediately notify you of any transactions deemed to be suspicious and allow you to confirm by replying to our SMS or email.
Citi Online security measures
The Citi Online website is constantly monitored by dedicated personnel 24 hours a day who review the website to identify opportunities to enhance the site's security and to maintain all the Citi Online services available for our customers.

A digital certificate (found by clicking on the Padlock Icon in the Status Bar at the foot of the page) is used to verify the identity and authenticity of Citi's websites.

Immediately upon signing in to Citi Online, you will see the date and time of your last sign in. Contact our Customer Service Centre immediately on 13 24 84 (+61 2 8225 0615 if calling from overseas) if you notice a discrepancy in the date and time of your last sign in.
Data encryption