• filter:
  • Text Only
  • Search this Topic »
Voting History
rated:
A week ago I received an email from Citibank that they were going to discontinue the downloadable version of their Virtual Account Numbers application which can be used to get a one-time use credit card number for use online.

I had used the web based version in the past, but I found the downloadable version to be much more convenient, so I was a little upset.

But now that I have tried to use the web-based version today, my upset has turned to anger.

They have implemented new security measures on the web-based app that makes it almost unusable for it's intended purpose.

Aside from the fact that you need to log in TWICE to use it (once on the web site and a second time within the app that pops up), aside from having to click on several buttons and check boxes to get to it, aside that the web-app itself lacks some very useful functionality that the downloadable version has (like drag and drop, always one top, etc.). The biggest, most ridiculous issue I have with the web-based VAN is that every time you launch it IT HAS TO CALL YOUR PHONE TO GIVE YOU A SECURITY CODE THAT HAS TO BE ENTERED ON THE WEB SITE!!!!!

Are you kidding me? Every time you need a VAN, you have to allow the system to call you or send you a text message with a code that you need to enter on the web site to allow the VAN app to run.

I use VAN all the time, this is just not acceptable to me.

I called and had a long discussion with the supervisor for the Citi website, and he was very courteous and took my complaints and said he would notify the people that needed to know. He also said that he did not think the verification would happen every time I tried to start the app, but it did for me. Try it out yourself and let me know if you have the same issue.


If you also have a problem with this, please call or otherwise notify them to let them know!

Supposedly, the downloadable app will be disabled starting tomorrow, so call now to give them your opinion!

Thanks!

Ads by Google
Member Summary
Most Recent Posts
Anyone else getting an issue where you're getting a message stating the billing zip code entered does not match the one ... (more)

DBL185 (Jun. 04, 2014 @ 8:20p) |

I'm not sure in what context you are getting that, but the VAN app seems to be working fine for me.

Maybe they need your ... (more)

Space (Jun. 04, 2014 @ 10:29p) |

Who is asking you for your zip code?  Ive never been asked for a zip code via VAN website.

spydermonkey (Jun. 05, 2014 @ 3:43p) |


rated:
I've been using the web version of the virtual account generator since it was launched. Not once have I had to have a security code sent. I just tried the service a few minutes ago and was able to get a virtual number like I have done in the past. No security code required. Even if it was required it's not a huge deal to me. I have to do it with my Chase account ever few weeks because I never save cookies.

If you use it all the time, just bookmark the url of the generator pop up window. It will take you directly to the generator login page.

rated:
Hey man, thanks for responding.

I just tried your suggestion and bookmarked the web VAN pop-up page and it looks like it works!

I don't need to enter any of that verification stuff and only have to log in once. I hope it stays that way.

I wish the people I talked to at Citibank would have just given me this information.

Thanks again.

rated:
At least you can login to VAN, after I changed my login and password for online banking, VAN stopped accepting either my old or new info

rated:
Were you using incognito mode on your browser?

rated:
No, but I do delete all cookies from my browser when it exits, except for a whitelist of sites.

I added both citibank.com and accountonline.com to the whitelist, but there may still be some domains that are used behind the scenes that need to be allowed.

I'll have to look in to it, but now that I have a direct link to the VAC web app bookmarked, it doesn't do any verification other than the normal login and password, which is just like the old downloadable app, so for now I am OK.

I still prefer the downloadable app because I can just drag and drop the CC number in to the "CC number" field on any web page, whereas with the web app I have to cut and paste, and that results in a number containing imbedded spaces that does not work on many web sites, so I end up having to type the whole number in manually. It also has "aways on top" so drag and drop (or copying the number) is easier.

I use a new VAN for EVERY transaction online, Paypal, Amazon, Newegg, whatever, so the quicker/easier the better.

There are too many stories of CC numbers being stolen from various web sites, so when that happens I don't want to have to worry, plus it prevents anyone from charging more than I authorized on the card.

rated:
Space said:   I use a new VAN for EVERY transaction online, Paypal, Amazon, Newegg, whateverOCD much?

I can understand using VANs at merchants that store your card info without giving you a choice, or even one VAN for each merchant. But using a new one for EVERY paypal or Amazon (which don't share your CC info with the other side) or Newegg transaction is INSANE.

rated:
Kdogg said:   I have to do it with my Chase account ever few weeks because I never save cookies.There's a solution for that, and its name is Firefox with the CookieCuller extension.

rated:
Space said:   
There are too many stories of CC numbers being stolen from various web sites, so when that happens I don't want to have to worry, plus it prevents anyone from charging more than I authorized on the card.


So you waste all of the time and energy of generating virtual cards to use at trusted retailers for every purchase so in the event of the off chance your CC# is stolen online you will not have to waste 2 min. to call and dispute the charges and get a new CC issued?

Edit: When in reality your number is going to end up comprised when you go out to eat or the gas station.

rated:
vipercon said:   Space said:   
There are too many stories of CC numbers being stolen from various web sites, so when that happens I don't want to have to worry, plus it prevents anyone from charging more than I authorized on the card.


So you waste all of the time and energy of generating virtual cards to use at trusted retailers for every purchase so in the event of the off chance your CC# is stolen online you will not have to waste 2 min. to call and dispute the charges and get a new CC issued?

Edit: When in reality your number is going to end up comprised when you go out to eat or the gas station.

+1

rated:
scripta said:   Space said:   I use a new VAN for EVERY transaction online, Paypal, Amazon, Newegg, whateverOCD much?

I can understand using VANs at merchants that store your card info without giving you a choice, or even one VAN for each merchant. But using a new one for EVERY paypal or Amazon (which don't share your CC info with the other side) or Newegg transaction is INSANE.


Big corps get breached. Remember TJX?

Inside jobs happen all the time too. It's not paranoia if you're right.

Besides, if Space uses the VAN generator all the time it shows Citi people are using it, so they can justify keeping it around for occasional users like me.

rated:
HI
I tried to bookmark popup page for VAN but it would not let me.
do you have the address
thank you

rated:
Edit: n/m arguing on the internet is like running in the....

rated:
This is the direct link to the web VAN app.

As for using it every time... I actually enjoy using it (up until I thought I had to start going through all that additional verification), plus it lets me see when the vendor puts a hold on my card (the available balance on the VAN is reduced by the amount of the charge, also letting me know if they are trying to charge me too much) and when they push the charge through (it appears on the transactions page).

I admit that most of the time this isn't very useful, but sometimes it can be, like in cases where you are not sure if a discount was applied (for instance I just bought something on Newegg that had an instant $5 off coupon that I used, yet the "UPS Tracking" email indicated the price without that discount, which would have normally made me wonder if they had mis-charged me) or if the vendor will even fulfill the order because of a price mistake (if they put a hold on the card it is likely that the order will be fulfilled), etc.

Anyway, I really don't buy that many things, so it's not like it is taking a major part of my life, it's usually just during December that I do a lot of online shopping.

rated:
Of course the other solution is to not buy anything online anymore. Support your local merchants.

I haven't used the VANs recently, but when I have it's for online sites I don't have much trust in. I've also used them a couple times where the price seemed ridiculously low. I set the limit just above the purchase amount. Good thing. Both times they emailed me saying my card won't work, when they attempted to charge more.

rated:
Space said:   plus it lets me see when the vendor puts a hold on my card (the available balance on the VAN is reduced by the amount of the charge, also letting me know if they are trying to charge me too much) and when they push the charge through (it appears on the transactions page).The same information is available on your card activity page. They recently (a few months or maybe a year ago) started showing authorized transactions and the exact amount on the activity page.

rated:
SomeOtherChick said:   scripta said:   Space said:   I use a new VAN for EVERY transaction online, Paypal, Amazon, Newegg, whateverOCD much?

I can understand using VANs at merchants that store your card info without giving you a choice, or even one VAN for each merchant. But using a new one for EVERY paypal or Amazon (which don't share your CC info with the other side) or Newegg transaction is INSANE.
Big corps get breached. Remember TJX?

Inside jobs happen all the time too. It's not paranoia if you're right.

Besides, if Space uses the VAN generator all the time it shows Citi people are using it, so they can justify keeping it around for occasional users like me.
TJX was a giant security negligence. If companies whose business it is to store your private information (paypal, Amazon), leave any holes open at all, it would be a serious threat to their entire business. They have highly trained and highly compensated technology professionals, so anything of the sort, even if theoretically possible, is extremely unlikely.

Security is about managing risk vs time and cost. As vipercon said, the time and effort spent on generating VANs for each transaction is a giant waste of time for an immeasurably tiny theoretical reduction in risk. And, as vipercon pointed out in the same post, you're much, much more likely to get your card information skimmed at a physical location than lose it through a breach at any known online merchant.

As an occasional user I'm happy others are using VAN, but not when they're abusing it

rated:
scripta said:   Space said:   plus it lets me see when the vendor puts a hold on my card (the available balance on the VAN is reduced by the amount of the charge, also letting me know if they are trying to charge me too much) and when they push the charge through (it appears on the transactions page).The same information is available on your card activity page. They recently (a few months or maybe a year ago) started showing authorized transactions and the exact amount on the activity page.Yep, just checked and there are three "Pending" transactions there, good to know, and one less reason to use it.

However, I will still continue to "abuse" the VAN service. I just like the idea of no online merchant having my credit card numbers. To each his own.

rated:
Space said:   I just like the idea of no online merchant having my credit card numbers. To each his own.There's a difference between no online merchant having your actual account number vs using individual numbers for each transaction with the same merchant over and over again. Just set a low enough credit limit on the VAN.

I'm just trying to point out that your fear of online merchants is misplaced. You are more likely to have your actual physical card cloned/skimmed by a minimum wage restaurant worker.

rated:
Space said:   Hey man, thanks for responding.

I just tried your suggestion and bookmarked the web VAN pop-up page and it looks like it works!

I don't need to enter any of that verification stuff and only have to log in once. I hope it stays that way.

I wish the people I talked to at Citibank would have just given me this information.

Thanks again.


I too very much dislike the change. I understand the need to move away from desktop version since it is based on flash and flash is for the most part dead. However, there are still other technologies. I favored the desktop version over the web browser based one since it also allowed drag/drop of account number and such. So, was sad to see the email as well. However, tried today to use the web based one and it asks for a phone number... stupid stupid stupid (no other way of saying it). Come on... and for those folks that will argue it's better security, sure it is but so is not being on the internet. There is going to be trade off between security and consumer business benefit. If it's not easy to use, then it won't be embraced. Maybe that is Citicorp's idea, they want to kill this off. I for one am already looking at alternative cards that will offer something similar (and hopefully with some smoother access). I found Chase and Discover offer virtual account numbers and will be checking them out.

Also, while on a rant... wouldn't it be nice to have a smartphone app, heck tie authentication to both username/password + phone identity (that may mean getting in bed with the carrier). I would even consider using one time passcodes like the RSA soft tokens but no chance consumer industry would share the same RSA authentication system amongst themselves.

Anyway, I saw this post while looking for alternative virtual account options since I couldn't create one that I wanted to use to setup my Dad's new iPad, which the Apple Store requires a credit card entry if you want to buy anything (I've always used virtual cards for all online sites needing a CC).

Citicorp/Citibank, did Santa leave coal in your stockings You take bail out money and then make it harder to use a benefit (yes, I fully ack it's a benefit and not standard service) that was a large reason I remain a citicard consumer. Wishing you a happier new year.

rated:
Please look for the link I posted in this thread, it allows you to access the web-based VAN app without having to go though the extra security (like requiring it to phone you).

I will miss drag and drop and "always on top" but at least all that additional security can be bypassed for the web VAN app.

By the way, the web-based VAN also uses flash, so no difference there.

rated:
supermanlives said:   I found Chase and Discover offer virtual account numbers and will be checking them out.Do you have a link to Chase showing that they offer virtual card #'s? I've investigated this in the past and determined that they [Chase] don't offer them. Have never checked out Discover's program but am familar w/ both Citi's VAN and BOA's ShopSafe. ShopSafe, to my knowledge, does not offer a stand-alone app the way Citi did. Speaking of Citi's stand-alone app, it appears like it still works (at least I could login & view my previously generated VANs).

rated:
Looks like the direct link to VAN no longer works. I too have been using a bookmarked version for quite some time (few years).

The idea of logging once into the account, then again into the van system is retarded. Citi will be getting a call from me shortly.

rated:
Yes, just noticed this as well.

It looks like they disabled the VAN downloadable app today (it gives you an "unavailable" message when you run it), and with that the direct link to the web app also no longer works.

So everything in my original posting is once again valid. This change is just not going to work for me, hopefully they will remedy it.

EDIT:

Is anyone else getting an error when they try to launch the VAN app on the website? Maybe they are just having temporary issues and the direct link may work again once resolved?

An error occurred while processing your request.
Reference #97.c40229de.1359642d47.914f84


EDIT 2:

OK, now I can't even log in to the CitiCards.com website. I guess they are having general problems.

rated:
Argh... I am having same issue. Reached here after searching online. F**king citi. Discover still offers a version of this two revisions behind - but doesn't have the same features (no ability to set limit/date or close)

rated:
Very frustrating indeed. Been using VAN from citibank forever. Never understand why they would eliminate something that OBVIOUSLY helps them deter credit card fraud.

I had a URL for directly going right to the Web version of VAN but I can't seem to find it this morning NOR can I find the link anymore within the citicards web site ARGHHHHH. Can someone please post it here? If not able to post a full url perhaps you can... http citi dot com slash van etc

THanks!

rated:
I can't give you a direct link to the app because it doesn't appear to work anymore, I will give you the steps to get there. Note that it is slightly more work than before, but I assure you it is for your benefit!

  1. Log in to CitiCards.com
  2. Click on "Benefits & Services" in the blue strip at the bottom of the top banner.
  3. Click on "Enroll/Get Virtual Account Numbers" at the top of the right column.
  4. Click on the green "Launch now" button.
  5. Check the check box next to "I have read and agree to these terms and conditions" ( make sure you read it first )
  6. Click on the green "I accept" button (just in case you were lying with the check box from the last step)
  7. Click on the green "Launch" button (just in case your previous pressing of the "Launch now" button was a mistake).
  8. Log in (yes, similar to step 1, but think of it as "memory exercise")
  9. Try to remember what you needed the VAN for in the first place, assuming the deal that you needed it for is still available.


You'll be thrilled to know that there used to be a step in there where Citibank had to call you via your registered telephone number to give you a code that had to be entered in to the website, this appears to be gone now (at least for me), but you may be lucky enough to get it!

Note that it currently seems to take an inordinate amount of time before the screen comes up for each step, so the whole process is just wonderful.

Don't forget to contact the delightful people at Citibank to express your satisfaction with the new process!

ENJOY!

rated:
1) login to CitiCards.com
2) tools/services, get virtual account number
3) click green launch now button
4) toggle agree and click accept
5) on the next screen, record the url for the launch button.

https://www.accountonline.com/cards/svc/VanWebConfirm.do?SYNC_TOKEN={some token hash here}

save that to a favorite

Next time

1) Login to CitiCards.com
2) click on favorite from #5 above. The VAN interface will open in a new tab/window.

It's not as robust as a direct link, but does eliminate a few clicks in between.

rated:
That won't work if you are not already logged in to the website. You need to log in in order to get that token, and the token expires after you log out or after a short timeout period.

rated:
*EDIT* Looks like the below, while it displays the VAN app, doesn't actually let you login. I keep getting a response of "Sorry, we are unable to connect to the server at this time. Please try again."

Took a look at the underlying code of the web-page and noticed the following:



defaultVars = "langcode=en&base=https://www.accountonline.com/VAN/webcard/&GeneralError=General+Error&loginAssetLib=loginlib.swf"
defaultVars += "&loadProfiles=true&cfg=config.prod.txt&Issuer=1&brand=Citi";
writeFlashObject("https://www.accountonline.com/VAN/webcard/CitiUS3.swf", "webcard", ieVars, nsVars, 730, 250, "11,2,0,0", false);

Combinng the URL in the last line above w/ the final definition of defaultVars results in the following URL:
https://www.accountonline.com/VAN/webcard/CitiUS3.swf?langcode=en&base=https://www.accountonline.com/VAN/webcard/&GeneralError=General+Error&loginAssetLib=loginlib.swf&loadProfiles=true&cfg=config.prod.txt&Issuer=1&brand=Citi
The combined URL above works for me in IE but not FF, although it displays an enlarged version of the VAN application (as no SWF window dimensions are provided). In FF it binary dumps the contents of https://www.accountonline.com/VAN/webcard/CitiUS3.swf. Another method which works (at least in IE), and which generates the "normal sized" VAN app, is to save the underlying HTML to a local file, then open that file in IE:
<META http-equiv="Content-Type" content="text/html; charset=UTF-8">
<title>Virtual Account Numbers</title>
<meta content="text/html; charset=iso-8859-1" http-equiv="Content-Type">
<noscript>
<STYLE TYPE="text/css">
body {display:none}
</STYLE>
</noscript>
<style>
	html {display:none;}
</style>
<SCRIPT LANGUAGE="Javascript">
if (self == top) {
		document.documentElement.style.display = 'block';
	} else {
		top.location = self.location;
	}
</SCRIPT>
<style type="text/css">
<!--
.Card     {  position: absolute; visibility: visible; left: 0px;  top: 0px}
.Comms    {  position: absolute; visibility: hidden; left: 0px;  top: 0px;}
-->
</style>
<script src="https://www.accountonline.com/VAN/webcard/disable.js" language="JavaScript"></script>
</head>
<body onload="focusMovie()" marginheight="0" marginwidth="0" topmargin="0" leftmargin="0" bgcolor="#003499">
<SCRIPT SRC="https://www.accountonline.com/VAN/webcard/webcard.js" LANGUAGE="Javascript"></SCRIPT><SCRIPT LANGUAGE="VBScript">
Sub webcard_FSCommand(ByVal command, ByVal args)
	call webcard_DoFSCommand(command, args)
End Sub
</SCRIPT><SCRIPT LANGUAGE="Javascript">
var defaultVars, ieVars, nsVars, thinclient;

thinclient = true;
defaultVars = "langcode=en&base=https://www.accountonline.com/VAN/webcard/&GeneralError=General+Error&loginAssetLib=loginlib.swf"
defaultVars += "&loadProfiles=true&cfg=config.prod.txt&Issuer=1&brand=Citi";

ieVars = defaultVars + "&Browser=IE";
nsVars = defaultVars + "&Browser=NS";



writeFlashObject("https://www.accountonline.com/VAN/webcard/CitiUS3.swf", "webcard", ieVars, nsVars, 730, 250, "11,2,0,0", false);
init();
focusMovie();
</SCRIPT>
</body>
</html>



Save the above as VAN.html, then open that saved file in IE. (Tried opening it in FF w/o success. It didn't dump the binary contents of the .swf, but it didn't launch the VAN app either).

rated:
^^Interesting...

Although it brings up the login box in IE, logging in doesn't seem to work. Comes back with Unable to connect to server at this time message.

rated:
VAN.html gets me to the login screen for the app in both IE and Firefox but I just get "Sorry, we are unable to connect to the server at this time" in both browsers.

rated:
Space said:   VAN.html gets me to the login screen for the app in both IE and Firefox but I just get "Sorry, we are unable to connect to the server at this time" in both browsers.Correct, which is why I placed an "EDIT" at the TOP of my post with that info. Maybe someone else will successfully hack VAN.html so that it truly works.

rated:
Getting absolutely same issues I've sent a complain to their customer service. However, I hardly believe they will fix the situation. I don't know why but it seems that virtual cards features are shrinking/closing everywhere around.

rated:
Are discover and schwab invest first and bofa still viable virtual account number options, may need to start preparing an alternative. Previous threads that reference alternative VANs are pretty old, so wondering which ones haven't been shut down by CC companies?

rated:
The new procedure for getting a VAN from Citibank is absolutely insane. I talked to customer service and their internet support group and all they do is apologize for this procedure. I have my Citibank Mastercard since 1985 and hate changing to another card. Are there any other cards which provide VANs? Thank you.

rated:
I believe it (the flash code) is detecting cross-site scripting (XSS) or "same origin" issues and throwing the error message.

I must say this is utter ridiculous for Citi to do this. With the billions credit card companies spend year after year on fraud, having everything possible to limit it should be a no brainer. It is no one else but their fault if they cannot promote such a solution as VAN to the masses. How illiterate do they think the masses are?

The fact that I was able to easily bring up the login to now having to login to the site itself, click multiple buttons just to get to the VAN login and authenticate there is a disgrace. The IT staff working on this or the directors/VPs allowing this should all be fired promptly. I don't care that they got rid of the windows app as I am a Linux user, but also crippling the web version is insane.

rated:
I called and complained and submitted multiple messages via the website. Everything went to a black hole. The web based window goes away after automatic logout (few minutes) and you have to go through the same ridiculous click click click process again. Just how many times do they want me to agree to the license agreement? What a Failure. I will be switching to another service. I think Netspend is offering VAN from the same processing company (Orbiscom).

rated:
The only reason I stayed with this worthless credit card company over the years was to use VAN. If VAN continues to now be a burden or it goes, I go too. There are many other rewards cards out there that are tempting and give much better rewards programs. I know personally that Citi has a bunch of IT idiots and there leadership staff is just money hungry pigs.

Skipping 237 Messages...
rated:
DBL185 said:   Anyone else getting an issue where you're getting a message stating the billing zip code entered does not match the one on the card? I've tried changing it even but no matter what I do it looks like Citi is now inserting 4 digits after the 5 digit zip code. Tried 'Zip Code-0000', 'ZipCode0000' and other variations and can't seem to get it to work. This only started happening the last few days.
  
Who is asking you for your zip code?  Ive never been asked for a zip code via VAN website.

  • Quick Reply:  Have something quick to contribute? Just reply below and you're done! hide Quick Reply
     
    Click here for full-featured reply.


Disclaimer: By providing links to other sites, FatWallet.com does not guarantee, approve or endorse the information or products available at these sites, nor does a link indicate any association with or endorsement by the linked site to FatWallet.com.

Thanks for visiting FatWallet.com. Join for free to remove this ad.

TRUSTe online privacy certification

While FatWallet makes every effort to post correct information, offers are subject to change without notice.
Some exclusions may apply based upon merchant policies.
© 1999-2014