Again, a phish that utilizes a good address bar forgery. These are getting very dangerous to unsuspicious customers, because very few obvious clues of phishing are left uncovered.

A weak spot in this scam is the e-mail message it's distributed through. It lacks Citibank logos and usual legit headers:

It's after clicking the link when the things get tricky. Design-wise, the phish website is an accurate replica of the legitimate site. Add the mentioned good address bar forgery and you get a very dangerous scam situation.

Notice how the real URL of the opened page is displayed on the 'properties' page of the phish site:

After starting - very believably - with a login screen, the phish continues with the 'main course' : asking for your debit card information.

The suspicious thing here - the padlock icon in the right part of the status bar (indicating a https secured session) is missing. It is highly unlikely that a legitimate institution would require sensitive information to be entered in an unsecured session.

To recapitulate - this phish attack tries to hide all visible clues of phishing from plain sight. The way to avoid being 'phished' is to exert extra vigilance towards the two main clues left - the URL in the properties page and the missing secure session indicator.

We recomend you to check all extraordinary 'events' - like this phish e-mail - with the legitimate site of the institution in question. The most reliable way to do it is to open a new browser window and type the URL manually.