ask for additional credentials - definitely.

Doing it as Citi does it? I don't know. But it seems Citi's security people believe it is unlikely that someone who has stolen an account username/pw would also be in possession of the debit/credit card and PI number (or the reverse - stolen the card/PIN and also have the account userid/pw) and therefore it is a good check.

However, I, too, would not enter that information over a public network.