Token Authentication Token Distribution Token Usage Security Issues Technical Issues           Token Authentication What is a security token? A security token is a small handheld device that dynamically generates and displays a password. When signing on to CitiBusiness® Online, users simply push a button on the token to display a password. This token password is entered along with the User ID and static password. The use of this token serves as the second level of security in our two-factor authentication process. What is two-factor authentication? Two-factor authentication is a security process that confirms a user's identity using two distinct factors - something they know and something they have. For CitiBusiness Online, the "something they know" is the current CitiBusiness Online password and the "something they have" is the password generated by a security token device. Individual tokens will be assigned to each user. Each token is valid for use only by the individual to whom it was assigned. Why is the extra security desirable? Perpetrators of online fraud are becoming increasingly sophisticated. By using a security token, the risk of fraud is reduced because individually assigned tokens can only be used in combination with a specific User ID and password. One of the reasons we are doing this now is in response to recent guidance issued by the Federal Financial Institutions Examination Council (FFIEC). Essentially, the FFIEC is calling for banks to provide additional protection for high-risk transactions, such as those that involve moving funds or accessing sensitive customer information. By adding two-factor authentication, we are simply strengthening our ability to offer a high level of protection.

Token Distribution

Who will be issued a token? All active CitiBusiness Online users will be required to use this two-factor authentication process in order to continue processing financial transactions (internal transfers, wire transfers, bill payments and account openings) and accessing cash management services (ACH, ARP, Controlled Disbursement, Lockbox Images, Online Investing and Trade Services) through CitiBusiness Online. Users who sign-on without their token password will be restricted to view-only account access. Users who have signed on at least once between October 1, 2005 and April 1, 2006 will be considered active. After April 1, 2006, users must sign-on to CitiBusiness Online at least once every 365 days to remain active. How will I get my token? Tokens will be shipped via overnight delivery to the primary contact on record for your company. This person will be responsible for distributing individualized token packages. Each token package will be labeled with a specific user's name. This is important as tokens are assigned by serial number, and can only be used by the designated user. What do I do when I receive the token? Once you receive your token and sign-on to CitiBusiness Online you will be presented with the token registration page. Registration is required and is a simple process that should take only a minute to complete. Once registered, you will need to enter the token generated password each time you sign-on to CitiBusiness Online. You will have approximately 25 days to register your token. During this 25-day period, you will have the same access you had before a token was issued. After the 25-day period, users who sign-on to CitiBusiness Online without using a token will be limited to view-only account access. How do I get tokens for new employees? The process of adding new users will remain unchanged. When new users are added, token packages will be shipped via overnight delivery to the primary contact on record for your company. This person will be responsible for distributing the token packages to users. Each token package will be labeled with a specific user's name. Return to Top

Token Usage

How will token usage work? At sign-on, CitiBusiness Online users will be required to enter the password generated by the token in addition to the User ID and static password currently entered. When the button is pushed, the token will display a password. Entry of the token password is required at sign-on to secure the online session. When do I start using a token to access CitiBusiness Online? Tokens will be distributed beginning this spring and continuing throughout 2006. The primary contact on record for your company will be notified several weeks before your company is scheduled to receive tokens. You should begin using your token as soon as you receive it. Will users need to begin using tokens immediately? Once tokens arrive, users will have approximately 25 days to register and begin using their tokens. After the 25-day period, users who sign-on to CitiBusiness Online without using a token will be limited to view-only account access. How do I register my token? Details about the quick and easy registration process will be included with the token packages provided to each user. Simply follow the instructions upon receipt. How do I sign-on with the token? Enter your User ID and static password as you do today then press the button on the token to display a password (Hold the token so the Citi logo is at the top and the button is on the left). Enter the token password in the "Token" field on the sign-on page and click "Sign On". How do I know which way to hold the token? You should hold the token so the Citi logo is at the top and the button is on the left. What should I do if I incorrectly type the token password? If you try to sign-on with an expired or incorrect password you will receive an error message prompting you to try again. Just use your token to generate a new password and try again. If you are still unable to sign-on after multiple attempts, you should contact Customer Service. Customer Service can be reached at 1 (800) 285-1709. What should I do if I leave my token at home? If you do not have your token but require access to CitiBusiness Online, contact Customer Service. Customer Service can be reached at 1 (800) 285-1709. Can I still access my accounts without using a token? A token is required to sign-on to CitiBusiness Online. If you sign-on without using your token, your access will be severely restricted. Will anything change in the approval process for transactions? With the exception of foreign currency wires, CD account openings, and CitiEscrow account liquidations, immediate approvals will be eliminated. Transaction instructions requiring additional approval will be routed to the Approvals queue. Due to the time constraints imposed for accepting foreign currency rate contracts, rate fluctuations for Certificates of Deposit and balance changes for CitiEscrow account liquidations, the elimination of immediate second approvals will NOT apply to these types of transactions. The process will remain as it is today; however the second approver will be required to enter both his static AND token passwords. What happens if my colleague and I mix up our tokens? Tokens are assigned by serial number, and can only be used by the designated user. If users mix up their tokens, the token password will not be valid for sign-on. If you need assistance in determining the token assigned to each user, contact Customer Service at 1 (800) 285-1709. Why do I have different devices for access to other Citibank applications? Currently, Citibank does not have a two-factor authentication method or token device that can be used for multiple applications. We are evaluating options and may offer a device that can be used with multiple Citibank systems in the future. What if I want to process financial transactions, but do not want to use a token? You will not be able to process financial transactions or access cash management or trade services without the use of a CitiBusiness Online security token. Use of a security token will provide the appropriate level of protection and will allow us to comply with recently published guidelines from the Federal Financial Institutions Examination Council (FFIEC). Return to Top

Security Issues

What should I do if my token gets lost or stolen? Call Customer Service immediately and report that your token has been lost or stolen. Customer Service can be reached at 1 (800) 285-1709. Will someone else be able to access my accounts if they find my token? Anyone who attempts to sign-on to CitiBusiness Online with your token will also need to know your Business Code, User ID, and static password. You should never write down this sensitive information, keep it with your token, or share it with anyone. You should report your missing token to Customer Service immediately. It is very important that you keep your token safe and secure at all times. Customer Service can be reached at 1 (800) 285-1709. Can I let someone else in my organization use my token? You should never share your token, User ID or password with anyone. How can I obtain a new token? Call Customer Service to request a replacement token. Requests are usually processed within 24 hours and tokens are shipped via overnight delivery to the primary contact on record for your company. Customer Service can be reached at 1 (800) 285-1709. Will I be charged for a replacement token? If your token is lost or stolen, you are entitled to one free replacement token within a 365-day period. Any additional tokens will cost $20 each. Fees will not be charged for replacements issued due to errors in fulfillment, token malfunction, or battery failure. Return to Top

Technical Issues
I know I typed the correct password but I cannot sign-on. Try to sign-on again, making sure you've correctly typed in your User ID, static password, and a new token generated password. If the problem persists, you should call Customer Service. Customer Service can be reached at 1 (800) 285-1709. Can the token be damaged when going through airport security? No, it is perfectly safe to walk through airport security with your token. How do I turn my token off? The token will turn itself off after 30 seconds. You can also push the button on the token to turn it off. What does "BATT" mean on my token display? Approximately one year before its battery runs out, the token will display "BATT 5" for a few seconds when the token is turned on. As the battery weakens over time, the message will change to "BATT 4", "BATT 3" etc. As soon as your token displays any battery warning, we recommend that you contact Customer Service for a free replacement. With normal use, your token battery is expected to last at least five years. Customer Service can be reached at 1 (800) 285-1709. Should I protect my token from extreme temperatures? Normal operating temperature range for a token is 4o Fahrenheit (-10 Celsius) to 113o Fahrenheit (+45 Celsius). Exposing your token to extreme temperatures may damage it. What happens if my token gets wet? If your token is submerged, it will stop working. You should contact Customer Service at 1 (800) 285-1709 for a replacement. Will my token work when I am traveling? Yes, if you have Internet access and can sign-on to CitiBusiness Online, you should be able to use your token regardless of physical location. Return to Top Top Three Online Security Threats Online Banking Security CitiBusiness Online Security Token