Citibank One Time Password (OTP)

[jingles]

Those having issues with the OTP how is your mobile number saved in your profile.
A friend was having problems with getting the OTP and citibank had 0's where they shouldn't be.

The country code should be '61' (not 061) and there should be no '0' at the start of your mobile number.

I've gotten used to Citi's login ritual with pop up box to select password.

Have a look here if you want to remove the pop up keyboard http://www.australianfrequentflyer....asily-accessing-citibank-online-no-42228.html

Off topic, your phone deal sounds good - what data allowance is built in??

Also have a look at amayasim, they use the optus network https://www.amaysim.com.au/
$39 will get you
Unlimited calls and sms to australian numbers (including 13 and 18 which some unlimited deals don't include)
4GB of data

Their international call rates are cheap too (from 6 cents a minute) which is rather good for calls from a mobile, not quite as cheap as using a voip account though.

 

[JohnK]

I don't like the idea of One Time Password as there is no guarantee my mobile is going to be with me at all times and when I am overseas I hardly ever use the Australian sim.

It is a nuisance to provide a choice of One Time Password or security choice each time I use Citibank website.

 

[Newk]

It's becoming compulsory

"Dear Newk
We feel strongly about online security.
So strongly in fact, we're about to roll out a smarter, more advanced online banking security system to keep you and your money safer.
In a few weeks, we will be removing the pre-login security questions and replacing them with our new One Time Password (OTP) security solution for online banking.
We'll also release a new version of our mobile app which will include the MobilePass feature - another way you can generate an OTP when banking online from your desktop or mobile device.

It's a code that we'll send via SMS to your mobile phone to authorise transactions in Citibank Online

When we make the move to OTP, you'll sign on to view your balances with just your Username and Password.
Then, to transact, or do anything where you'll have access to your funds, we'll send you an SMS with an OTP. Just enter the OTP to perform as many transactions as you like whilst you're signed in for that session.
You'll get a new OTP each time you sign in and want to transact."


It's not a bad system. But I can see difficult situations if you are separated from your mobile phone

 

[Cruiser Elite]

It's not a bad system. But I can see difficult situations if you are separated from your mobile phone

Or if you are O/S with foriegn SIM card installed.

 

[Baysider]

I just returned from a trip where Virgin Mobile somehow stopped me from receiving any incoming text messages between 2 January and 13 January. OTP would have been useless!! The concept is ill-conceived.

 

[trippin_the_rift]

I've been forced to use OTP to make payments using citibank transactional accounts for some time now.

The SMS system is pathetic. It's as if Citibank is using international delivery channels instead of on-net SMS which would be instant.
My experiences are SMS can take 15-20mins to arrive, after which the session has ended and you need to start again...

It is possible to do a check on a mobile# to see if they are currently connected to their home network and if they're globally roaming. Doing this prior to sending a text message might be a good workaround to avoid the international problem, however it's a bit tech.

 

[wafliron]

It's not a bad system. But I can see difficult situations if you are separated from your mobile phone

Have to respectfully disagree with you there.

Even a great SMS-based OTP system is a mistake for a user-base the size of Citi's when there is no self-service "backup" or "recovery" option - and from the reports of many it sounds like their system is far from great!

We use a SMS OTP system for VPN authentication at work, and with only 100-odd Australia-based users it still produces several occurrences of users not being able to connect per week. SMSes simply disappear (network-level issues - we can see that they've been sent from our end), coverage issues, mobile network outages, etc. It's still a great system for us - much better than any alternative I can think of - but it only works because of the low user count and some "backup" options we have in place. There's no way in hell I'd roll it out in a situation like Citibank's.

 

[JohnK]

It's not a bad system. But I can see difficult situations if you are separated from your mobile phone

As already mentioned I can see how this will be a problem for me in Thailand if I want to use Citibank. Take out Thai sim to put in Australian sim and then put Thai sim back in again.

I do not want to be opening my wallet too much in internet shops. And it is isn't just Citibank. Hotmail keeps asking for sms authorisation. Amex also has introduced account authentication. Using 28 degrees to pay for Air Asia flight also involved sms. And the list goes on and on....

 

[dajop]

Or if you are O/S with foriegn SIM card installed.

Or if you live overseas and don't have an Australian SIM that works outside of of Australia. Don't know what will happen for me when they make it compulsory, I have given foreign number but it is not in the OTP field.

 

[lovetravellingoz]

Good idea.

Don't like it myself. I often travel internationally without a mobile. If it became compulsory I would stuffed at such times.

I got caught out once in France with my Westpac online account where you get sent an SMS for all new accounts that you pay to for the fist time. I understand the security, but if it is the only option you can get caught out.

 

[burmans]

Or if you are O/S with foriegn SIM card installed.

That's my concern, so it may be impossible to check my accounts online when I'm overseas, just the situation when I'm most in need of the facility! Like Baysider too I have been in situations when the texts don't come through for hours or more.

 

[A330]

If you use the iPhone app the OTP is not asked for. It just uses the regular security questions.

May be useful for when overseas (although the app is not that great).

 

[dajop]

If you use the iPhone app the OTP is not asked for. It just uses the regular security questions.

May be useful for when overseas (although the app is not that great).

So does the website, at the moment. They are moving to compulsory OTP, not sure of cutover date, I suspect app will also be updated then.

 

[A330]

So does the website, at the moment. They are moving to compulsory OTP, not sure of cutover date, I suspect app will also be updated then.

AFAIK the website currently prompts you to switch to OTP. The app doesn't even offer you the chance to use OTP.

 

[rowdy]

We'll also release a new version of our mobile app which will include the MobilePass feature - another way you can generate an OTP when banking online from your desktop or mobile device.

I'm guessing this will be an app version of the keyring gadgets that you press the button to generate a OTP, so SMS maybe not required when this is released?

 

[wafliron]

I'm guessing this will be an app version of the keyring gadgets that you press the button to generate a OTP, so SMS maybe not required when this is released?

Sounds like it. I missed this in Newk's original post... very good to see this as an option, it makes the whole system a lot more palatable.

 

[ashleyn]

I gave negative feedback on their website about OTP and actually got a call about 4 hours later. The caller just did the hard sell saying they would have a token you could use, app when offline, etc, missed the main points altogether.

 

[Newk]

I gave negative feedback on their website about OTP and actually got a call about 4 hours later. The caller just did the hard sell saying they would have a token you could use, app when offline, etc, missed the main points altogether.

correct me if I am wrong. If you and your phone are separated (theft, misplaced etc) how's this going to work?

Bad enough, for many reasons, as well pointed out here, when overseas.

Citibank have great cards that do great things, and a terrible web site and variable service
Amex who is annoying everyone with the changes to points has a great web site and less variable service
Discuss...sorry OT

 

[wafliron]

correct me if I am wrong. If you and your phone are separated (theft, misplaced etc) how's this going to work?

I'd say: it's not. Having an app-based OTP generator will make it a lot better than just SMS, but it still leaves significant gaps in the system, particularly if you lose access to your phone while overseas.

 

[Newk]

I'd say: it's not. Having an app-based OTP generator will make it a lot better than just SMS, but it still leaves significant gaps in the system, particularly if you lose access to your phone while overseas.

and yes, this could be when it is most needed on both sides of the equation.
I agree with you when you disagreed with me earlier when I said something like "it's not too bad"