Fake Citi 'debit card added to Bitcoin wallet' email leads to login-citibank.replit.app phishing page

What happened

MalwareTips reports in a post published October 21, 2026 on a Citi Debit Card Update email scam that claims the recipient's card has been added to a Bitcoin wallet and asks anyone who did not authorize it to review the change through a link. According to MalwareTips, the documented phishing page imitates a Citibank login and asks for a user ID and password; a reported address is login-citibank.replit[.]app. Citi is being impersonated and is not involved, and MalwareTips says Replit's hosting does not authenticate the page or implicate the platform. MalwareTips notes no account intrusion or payment was independently tested. It advises opening the bank's app or contacting the bank through a trusted number instead of using the email, and changing credentials if they were entered.

How the scam works

MalwareTips says the email works by creating alarm: a card supposedly linked to a Bitcoin wallet suggests that someone is about to spend the account holder's money, and the message invites anyone who didn't authorise it to 'review' the change. The review link leads to the fake login page, which asks for a user ID and password. If a later screen asks for a one-time code or push approval, MalwareTips says to reject it, because that can let criminals complete a login or payment.

MalwareTips notes its pictured message uses an invented sender to illustrate the pretext and is not evidence of a real card being linked to a wallet. It advises against trying several passwords to see which one works, as that can expose credentials used for other accounts. Anyone who entered details should contact the bank promptly and explain exactly what was entered or approved.

Source

MalwareTips, "Citi Debit Card Update Email Scam: The Fake Bitcoin Wallet Sign-In Alert" (published 21 October 2026).