OP, legendary drop. This is still one of the cleanest Citi plays circulating in 2025 even after their “Falcon 2.0” rollout in June. I’ve personally cooked 47 Citi personal + 9 CitiBusiness accounts since September with this exact skeleton and a few critical upgrades. Total pulled: $1.18 M gross, $870 k net after mules/fees/reversals. Zero arrests, one seizure (recovered via lawyer).
Here’s the
current 2025 working meta – everything that’s still alive after the big patches.
1. Fullz Requirements (Mandatory now)
- Age: <45 days old (older than that = 90 % lockout on first login)
- Must include: SSN4 or full SSN, exact address with unit #, mother’s maiden, previous address, Citi online banking username/password if pre-made, selfie + DL front/back, phone carrier (for proper SMS formatting)
- Best sources right now (private only): @ValidDumpKing (TG), invite-only section, and a Russian shop that still drops Citi with 95 % login rate (escrow only).
2. Antidetect + Device Fingerprinting (This is 70 % of success now)
Citi is fingerprinting at the kernel level. Forget regular antidetect browsers. Working stacks November 2025:
- Dolphin Anty (new “Citi Profile” preset) + residential proxy from the exact same ZIP as the fullz → 94 % success
- Incogniton with Canvas + WebGL + WebRTC spoofing + custom fonts disabled
- Rooted Android 14 emulator (Frida + MagiskHide) running the official Citi app → this is the golden ticket, 98 % bypass rate → Use “Android Emulator Spoofer” module + Smali Patcher to fake safety-net
3. Login & 2FA Bypass – Current Working Paths
Path A (80 % of my logs): Mobile app → “Forgot password” → answer KBA using fullz → triggers email code only (SMS is now almost always blocked on new devices) → have the exact Gmail/Yahoo linked in the fullz already phished or use session cookie from seller.
Path B (CitiBusiness & high-limit personal): Call 1-800-374-9700 → Indian call center → say “I’m traveling abroad, device is new, can you push voice call to the number on file?” → they almost always do → you control the VoIP → instant access.
4. Loading Methods Ranked by Success Rate (Nov 2025)
- Zelle to your own drop (OnJuno, Varoo, Wise Business) → 97 % success, limits raised to $15 k/day after 14 days of warming
- Internal “Pay a Person” using email/phone → $10 k/day instant
- BillPay to fake utility (create real-looking invoices with real merchant MCC) → $25 k+
- ACH pull from mule (still works but velocity triggers after $9 k in 24 h)
- Buy Citi prepaid cards online → instant $5 k chunks, unload at CoinFlip ATMs
- Apple Pay → add card → buy Visa gift cards on giftcards.com → dead after Oct 17 patch
5. Warming Routine (Skip this = instant lock)
Day 1–3: Log in, check balances, change password, update security questions, add your drop as “trusted device” Day 4–7: $200–500 small Zelles to your own drops, pay fake Verizon bill $800, browse statements Day 8+: Go full send
6. Best Drops Right Now (Still Alive)
- Mercury Bank (business) – $150 k/week if warmed
- Wise Business (EU entity) – $80 k/day
- OnJuno metal accounts – $25 k/day Zelle
- Revolut Business (UK LTD) – takes wires, then SEPA out
- Local BTC buyers with ID (60–65 % rate, cash in hand same day)
7. Red Flags That Will Kill You in 2025
- Logging in from a state the cardholder has never lived in
- First transaction >$3 k
- Using TextNow/Google Voice for 2FA (Citi blacklisted the entire ASN ranges)
- Not matching exact timezone + daylight savings
- Buying BTC directly from the checking account (instant review)
8. My Personal Success Stats (47 accounts, Sept–Nov 2025)
- Average balance accessed: $41 k
- Average cashed per account: $26 k
- Reversal rate: 11 % (all from accounts older than 60 days)
- Account lock rate on first login: 6 % (all fixed with phone verification)
- Profit after mules (20 %), fullz cost, tools: 71 %
If you’re still doing this manually in 2025 you’re losing money. I have a private Selenium + OpenCV bot that does the entire warming + cashout cycle on 12 accounts simultaneously (cost me $12 k to build). Taking 3 students at $15 k each if anyone wants the sauce (vouched only).
Stay safe, never get greedy, and remember: Citi is watching literally everything now. One wrong fingerprint and you’re on a 10-year blacklist.
DM for fullz, aged Citi logs with cookies, or the bot. Middleman mandatory.
