Treasury and Trade Solutions

CitiDirect Mobile Token Overview ®

Frequently Asked Questions

1. What is CitiDirect® This is a new login credential available on the CitiDirect mobile app that enables users to
mobile token? login to CitiDirect® desktop, mobile and tablet.

2. Why should I try it? Setup is easy, activation takes just minutes, and login is easier than before!

3. Will I be able to continue • Existing users can keep using their Safeword cards after they activate the mobile token.
to use my SafeWord Existing SafeWord cards will not be deactivated.
card, MobilePASS or
• In some markets*, MobilePASS will be de-activated upon the user’s next successful login
any other CitiDirect
with the newly assigned and activated Mobile Token. The user will be informed about
credential?
MobilePASS de-activation with a systemic message and email notification. The Security
Manager will be notified by email.

4. Can a new CitiDirect New CitiDirect users can be created/provisioned with:

user be created with
1. Mobile token only
multiple credentials,
e.g., MobilePASS, 2. MobilePASS only
mobile token, and
3. MobilePASS and SafeWord card
SafeWord card?
4. SafeWord card only

Users with the above credentials can also activate biometrics authentication if enabled by
their security managers. In some cases, clients may have biometrics pre-selected by Citi
to help with the setup of convenient and secure login experience with biometrics.

5. Will this new login No; however, users in China can use the similar token referred to as China mobile token.
method be available for
CitiDirect users
in China?

6. Is a data/Wi-Fi Yes.
connection required
to activate the
mobile token?

7. How is CitiDirect mobile CitiDirect mobile token is a new, upgraded mobile token for CitiDirect desktop, mobile app
token different from and tablet login. It is embedded on the CitiDirect mobile app and offers a fast and intuitive
MobilePASS? activation process.

Eventually MobilePASS will be discontinued in favor of the new CitiDirect mobile token,
and we will notify you and your users before doing so.

*Algeria, Austria, Bahamas, Bahrain, Belgium, Bulgaria, Canada, Cameroon, Democratic Republic of Congo, Cote D’Ivoire, Croatia, Cyprus, Czech Republic, Denmark,
Egypt, Estonia, Finland, Gabon, Ireland, Jersey, Jordan, Kazakhstan, Kuwait, Kenya, Luxembourg, Netherlands, Nigeria, Norway, Romania, Senegal, South Africa, Tan-
zania, Uganda, Zambia. New countries from October 7, 2023: France, Germany, Greece, Hungary, Israel, Italy, Latvia, Lebanon, Lithuania, Morocco, Pakistan, Poland,
Portugal, Qatar, Russian Federation, Slovakia, Slovenia, Spain, Sweden, Switzerland, Tunisia, Turkey, Ukraine, United Arab Emirates, United Kingdom.
Treasury and Trade Solutions

8. Are there any changes No. The existing security procedures that are currently in place relating to mobile
to the TTS Security application based soft tokens will continue to apply with respect to the CitiDirect mobile
Procedures for this new token; nothing has changed in this regard.
CitiDirect mobile token?

9. Am I able to use multiple Yes; however, each activation requires the user to create a new passcode.
tokens for different
client definitions on one
mobile device?

Setup — Security Managers

1. How do I set up my users The CitiDirect mobile token is available in approved markets. If enabled for a particular
for this login method? country and client definition, security managers (maker/checker) can go to Self
Service/Users & Entitlements/Users/All Users and add this new credential by selecting
“Mobile Token”.

2. Can existing users Yes — provided that your organization’s Client Preferences are enabled to “Allow Users to
request this new Request Mobile Token”. This option can be found under Self Service/Client Settings/Client
login method through Preferences-New/All Client Preferences/Global.
CitiDirect?
Once “Allow Users to Request Mobile Token” is enabled, existing users may:
• Log into CitiDirect on their laptop, go to Settings/Authentication and request this new
login method or tap the “sign up” button upon logging out of CitiDirect. To learn more,
please see the Security Manager guide.
• Log into the CitiDirect Mobile app and tap on the “Would you like to enable Mobile
Token” banner at the top of the My ToDos screen.

Note: if your organization’s “Default Credential Type” is set to “Mobile Token”, the “Allow
Users to Request Mobile Token” client preference will automatically be selected. Security
managers (maker/checker) can always uncheck the “Allow Users to Request Mobile
Token” client preference to disable the user self-request option if it is no longer desired.

3. Can users in my Yes. This can be restricted in Client Preferences or the All Users screen. Please see the
organization use mobile Security Manager guide for details.
token for login with
limited access to the
mobile app?

4. When must I approve • Existing MobilePASS users can request the mobile token without security managers’
users’ self-request for approval. An email notification will be sent to security managers when users request
the mobile token? mobile token.
• Existing SafeWord card and/or Biometric Authentication users who are not also
MobilePASS users will require a security manager’s approval before enablement.
Treasury and Trade Solutions

5. Can Citi enable “Allow Yes, in some cases, clients may have this option pre-selected by Citi to help with the
Users to Request transition to the upgraded mobile token.
Mobile Token” so that
as a security manager I Note: security managers (maker/checker) can always uncheck the “Allow Users to
don’t have to? Request Mobile Token” client preference to disable the user self-request option if it is
no longer desired.

6. After upgrading to the No, all user entitlements remain the same.
mobile token will any of
the user’s entitlements
change within
CitiDirect?

Setup — Users

1. How do I download the • Go to the Google PlayTM or the Apple® App Store®
CitiDirect mobile app?
• Search for “citidirect”
• Download the app

2. What mobile operating The CitiDirect mobile app, including the new mobile token, works on the iOS and Android
systems do this mobile mobile operating systems and is compatible with versions iOS 12 and above, and Android
token support? 7 and above.

Activation

1. How will I get my • You will receive an email with a QR code, a numeric activation code, and activation
activation details? instructions.
• During the activation process, you must enter a one-time verification code sent by
SMS or Voice call.

2. Can I activate from my No. Activation happens on the mobile phone.

computer or tablet?

3. I received the activation The QR code is valid for 10 calendar days. This period begins once the email has been sent
email — how long is the (e.g., if the email was sent on January 1, the code will expire on January 11). Users can
QR code valid? now re-activate the expired code during the activation process by selecting “Send New
Activation” on the Mobile app. This is only possible within 60 days from initial activation.

For assistance, contact your security manager or Citi Service Representative.

Treasury and Trade Solutions

4. What happens if I cannot First, check all folders of your mailbox,including spam/junk.
find my activation
If you still cannot locate the email, it can be resent in one of the following ways:
email containing the
QR code and activation 1. Users can request the activation email to be resent by inputting their user ID into
instructions? the CitiDirect Mobile app, tapping “YES” when asked if they want to proceed with
activation, then by tapping on the “Resend” link.
2. Your security manager can re-activate the mobile token from CitiDirect and you will
receive an activation email.
3. Existing MobilePASS/SafeWord card users can request the activation email by logging
into CitiDirect on their computers and going to Settings/Authentication/Reactivate.

Note: the “Allow Users to Request Mobile Token” box must be enabled in Client
Preferences in order to take advantage of this option.

5. What should I do if I do After 60 seconds, you can request another one-time code. If no SMS is received after the
not receive an SMS with second attempt, you may request a voice call.
a one-time verification
code when requested?

6. What should I do if I Contact your security manager — they can generate the one-time verification code for you.
still do not receive the
SMS/Voice one-time
verification code after
requesting it?

7. Can I copy/paste the Yes. You may copy/paste the one-time code.
code from the SMS into
the screen?

Re-activation

1. How do I re-activate the • Security managers can re-activate the mobile token on your behalf. Please see Security
mobile token if I lost Manager guide for details.
my email, forgot the
• Existing users with Mobile Token or an alternative credential (i.e., MobilePASS) can
passcode, or changed
request an activation email by logging into CitiDirect on their computers and going to
my device?
Settings/Authentication.
• When changing their mobile device, users can request the activation email to be resent
by selecting Settings/Tap for a new activation email in the CitiDirect Mobile app and
tapping “Proceed” when asked if they want to activate on their new mobile device.

Note: the “Allow Users to Request Mobile Token” box must be enabled in Client
Preferences to take advantage of this option.

2. Can I re-activate MobilePASS reactivation is no longer available for clients enabled with Mobile Token.
MobilePASS if I have Users will be assigned with Mobile Token as a new login credential instead of reactivating
both: MobilePASS and MobilePASS. Once submitted and approved, the activation email with details will be sent
Mobile Token? to the user.
Treasury and Trade Solutions

3. What should I do if I Go to the Apple App Store or Google Play Store, search for “citidirect” and you can
mistakenly delete the re-download the app. Then contact your security manager for a new re-activation code.
CitiDirect mobile app You may also login to CitiDirect with an alternative credential (i.e., MobilePASS) and
from my phone? reactivate in Settings.

4. How do I change my • Security managers can update your phone number on your behalf.
mobile number before
• Existing users can also log into CitiDirect and update their mobile number by selecting:
I re-activate Mobile
Settings/Authentication/Mobile Country Code/Telephone. Once submitted, a Security
Token?
Manager will need to authorize the change before it goes into effect.

Login

1. How do I log into • Go to the CitiDirect homepage.

CitiDirect on my
• Input your CitiDirect User ID and tap Continue.
computer using this new
login method? • If prompted, enter Password.
• Once you see a QR code on screen, open the CitiDirect mobile app on your mobile
phone, tap “Desktop/Tablet Login” and then enter the passcode.
• Point your mobile phone’s camera at your computer screen to scan the QR code.
Once the scan is successful, you’ll see a response code on your phone.
• Input this response code into the login screen and tap continue.

2. Can I continue logging • In some markets*, MobilePASS will be de-activated upon the user’s next successful login
into CitiDirect with with the newly assigned and activated Mobile Token. The user will be informed about
MobilePASS on my MobilePASS de-activation with a systemic message and email notification. The Security
computer after I have Manager will be notified by email.
activated the new
• Existing SafeWord cards will not be deactivated.
mobile token?

3. How do I log into the • After you’ve successfully activated, open up the mobile app.
CitiDirect mobile app on
• Tap the Mobile Login button.
my mobile device using
this new login method? • Input your passcode — for those who have enabled biometrics authentication, you can
authenticate here.

4. How do I log into the • You have to activate the mobile token on your mobile device first.
CitiDirect mobile app
• Open CitiDirect Mobile app on tablet.
on my tablet using this
new login method? • Input your CitiDirect User ID and tap continue.
• If prompted, enter Password.
• Once you see a QR code on screen, open the CitiDirect mobile app on your mobile
phone, tap “Desktop/Tablet Login” and then enter the passcode.
• Point your mobile phone’s camera at your tablet screen to scan the QR code. Once the
scan is successful, you will see a response code on your phone.
• Input this response code into the tablet login screen and tap continue.

*Algeria, Austria, Bahamas, Bahrain, Belgium, Bulgaria, Canada, Cameroon, Democratic Republic of Congo, Cote D’Ivoire, Croatia, Cyprus, Czech Republic, Denmark,
Egypt, Estonia, Finland, Gabon, Ireland, Jersey, Jordan, Kazakhstan, Kuwait, Kenya, Luxembourg, Netherlands, Nigeria, Norway, Romania, Senegal, South Africa, Tan-
zania, Uganda, Zambia. New countries from October 7, 2023: France, Germany, Greece, Hungary, Israel, Italy, Latvia, Lebanon, Lithuania, Morocco, Pakistan, Poland,
Portugal, Qatar, Russian Federation, Slovakia, Slovenia, Spain, Sweden, Switzerland, Tunisia, Turkey, Ukraine, United Arab Emirates, United Kingdom.
Treasury and Trade Solutions

5. If I log into CitiDirect For users logging into CitiDirect on their computers or tablet they will re-authenticate by
using the mobile scanning the QR code with their mobile device.
token, how will I re-
authenticate? For users logging into CitiDirect on their phones, they must input their mobile token
passcode to proceed.

6. How do I log into the 1. On your desktop/tablet, you should select the “Can’t scan” option.
desktop using my
2. On your mobile phone, you should select the “Use other token” option.
SafeWord card or
MobilePASS on the
desktop if for some
reason I cannot use
mobile token?

Security

1. Does activation require a Yes. You cannot activate the mobile token without a phone lock securing your mobile device.
lock on my phone?

2. As a security manager, Yes. security managers may deactivate users or remove this new login method in
can I deactivate a user? CitiDirect/Self Service.

Treasury and Trade Solutions

citi.com/treasuryandtradesolutions
© 2023 Citigroup Inc. All rights reserved. Citi, Citi and Arc Design and other marks used herein are service marks of Citigroup Inc. or its affiliates, used and
registered throughout the world.
2205447 10/23