What a Secure Transaction Code is and why you need one

A Secure Transaction Code (STC) is a one-time password that Citibank sends to verify your identity when you're making certain transactions online or by phone. If you're an authorized user on someone else's Citi account, you may need your own STC to access account features, make changes, or complete sensitive actions — depending on what the primary account holder has allowed you to do.

Citibank sends STCs by text message or email, and they expire after a short time (usually 10 to 20 minutes). The code is tied to your phone number or email address, not the account itself, so you'll need to have registered contact information with Citi before you can receive one.

Not every authorized user needs an STC for every action. The primary account holder controls what permissions you have, and some transactions don't require a code at all. If you're trying to do something and Citi asks for an STC, it means that particular action requires verification.

Key Takeaways

  • You need a phone number or email address registered with Citibank to receive a Secure Transaction Code.
  • The primary account holder must add you as an authorized user before you can request an STC.
  • STCs are sent by text or email and expire within 10 to 20 minutes, so you'll need to use it quickly.
  • Call Citi's customer service at the number on the back of your card if you don't receive a code or if it expires before you can use it.

Registering your contact information with Citi

Before Citibank can send you an STC, they need to have your phone number or email address on file. If you're an authorized user, your contact information may already be in the system — but you should verify this before you need a code in a hurry.

Log into your Citi account online or through the mobile app. Go to your profile or account settings and look for a section labeled "Contact Information," "Notifications," or "Security Settings." Check that your current phone number and email are listed. If either is missing or outdated, update it now.

If you don't have online access to the account yet, call Citibank at the number on the back of your card and ask a representative to confirm your contact information is correct. They'll verify your identity and add or update your phone number and email if needed.

Requesting an STC when you need one

When you're in the middle of a transaction and Citi asks for a Secure Transaction Code, the system will usually give you the option to receive it by text or email. Choose whichever method is fastest for you — text is usually quicker if you have your phone with you.

Citibank will send the code within a minute or two. Open the text message or email and enter the code into the field where Citi asked for it. The code is case-sensitive and expires quickly, so don't wait. If the code expires before you use it, you can request a new one.

If you don't receive the code after a few minutes, check that your phone number or email is correct in your account settings. If it is and you still haven't received anything, hang up and call Citi directly. A representative can resend the code or help you complete the transaction another way.

What to do if you don't receive the code

If Citi sends an STC but you never get it, the most common reasons are an outdated phone number or email, a problem with your phone carrier's text delivery, or a spam filter catching the email. Check your spam or junk folder first — sometimes banks' messages end up there by mistake.

If you find the email in spam, mark it as "not spam" so future codes arrive in your inbox. If you don't find it anywhere, log into your Citi account and update your contact information, then request a new code. If you still have trouble, call Citibank's customer service line (on the back of your card) and explain what happened. They can verify your identity over the phone and either resend the code or complete the transaction for you.

If you're using a landline or a number that doesn't receive text messages, ask Citi to send the code by email instead. Some older phone plans or international numbers may have trouble receiving SMS texts, so email is a good backup.

STCs for different types of transactions

Citibank requires an STC for high-security actions like changing your password, adding a new payee for bill pay, transferring money to an external account, or updating your contact information. You may not need one for everyday actions like checking your balance or viewing recent transactions.

As an authorized user, the transactions that require an STC depend on what permissions the primary account holder gave you. If you're only allowed to view the account, you probably won't need an STC at all. If you have permission to move money or change settings, you'll need one for those actions.

If you're unsure whether a particular action requires an STC, try it. Citi will tell you if a code is needed before you go any further. There's no penalty for attempting a transaction and being asked for verification.

Setting up text or email preferences

You can choose whether you want to receive STCs by text, email, or both. Log into your Citi account online and look for "Notifications," "Communication Preferences," or "Security Settings." Select which methods you prefer for receiving security codes.

If you change your phone number or email address, update it in your account settings right away. Citi won't be able to send you an STC at an old number or address, and you may get locked out of transactions that require verification.

Some authorized users set up both text and email so they have a backup if one method fails. This is especially useful if you travel or if your phone service is sometimes unreliable.

Frequently Asked Questions

Can I request an STC if I'm not the primary account holder?

Yes, as long as you're registered as an authorized user and have contact information on file with Citi. When a transaction requires an STC, Citi will send it to the phone number or email you registered. If you don't receive it, call Citi to confirm your information is correct.

How long does a Secure Transaction Code stay valid?

Most STCs expire within 10 to 20 minutes. The exact time depends on the type of transaction. If your code expires before you use it, you can request a new one. There's no limit to how many times you can request a new code.

What if I lose my phone and can't receive text messages?

Call Citibank immediately at the number on the back of your card. Tell them you've lost your phone and can't receive texts. They can send the code by email instead, or they may be able to complete the transaction for you over the phone after verifying your identity.

Do I need an STC every time I log into my Citi account?

No. STCs are only required for specific high-security transactions, not for logging in. You may be asked for an STC if you log in from a new device or location, but regular login doesn't require one.

Can the primary account holder see when I request an STC?

The primary account holder can see transaction history and account activity, but they typically won't see a notification every time you request a security code. They will see the actual transaction you completed using the STC.