A new Citibank phishing scam is underway that utilizes a convincing domain name, TLS certs, and even requests OTP codes that could easily cause people to believe they are submitting their personal information on a legitimate page. It is not known how users arrive at this phishing site, whether it be from an email or SMS text, but when they visit the update-citi.com landing page found by MalwareHunterTeam, they will be presented with a convincing login page. Each page of information that is entered will be submitted to the attacker’s server and when done, the landing page will state it is authenticating your data.
Source: https://www.bleepingcomputer.com/news/security/this-citibank-phishing-scam-could-trick-many-people/