I'm currently in HKG using the hotel wifi.

In order to log into my Citibank account to check on something, after entering my username and password, a screen popped up asking me to enter both the debit card number and the PIN.

Even assuming that I am not the victim of phishing, which is fairly unlikely since I went to the Citibank site myself, the wifi I am using is certainly not at all secure and HK is, after all, part of China.

So I called Citibank, went through voice jail, and an agent and her supervisor said that until I did what the site demanded, I can't access my account online. As I got the info I needed over the phone, I guess this can wait until I get home where the wifi, at least, is more secure.

But what sort of fool at Citibank thought this one up? They have ALL SORTS of other information they could ask for that has a lower risk of having my account drained by a bad guy.

P.S. I can't fix this by going into a local branch since outside the USA, Citibank offices don't cooperate with Citibank USA, except for the ATM machines. Please don't ask what I went through to learn that!