I've been getting notes from people wondering why Citibank would be sending me a Trojan Horse. The answer is that they haven't been, the email I got was forged, but that is trivial. Anyway, Citibank is investigating, though, I don't know what they can do. ... Well, that reminds me, it's been over a year since I last checked up on the citibank sites and notified them of their website problems. I told them about their XSS security problems, some of which they fixed, some of which they didn't. When you find a security problem on your site, you should fix it everywhere.