Citibank statements appear regularly in screening and underwriting files, particularly from applicants in large metropolitan markets where Citi's retail presence is concentrated, and an edited statement seldom looks edited. What a reviewer can rely on is structure: a genuine Citi statement is a set of interlocking numbers—summary totals, per-account activity, and balances—that must agree with each other and with the file's own metadata. The checks in this guide are ordered so the cheapest and most objective tests come first, and so each failed test produces a concrete next step: a specific question for the applicant or a request for a fresh, source-downloaded original.
Hold onto two disclaimers throughout. Passing every check is not authentication—a meticulous forgery can be arithmetically perfect, which is why leases, loans, and offers that matter should escalate to source verification rather than stopping at file review. Failing checks is not fraud, either: real statements get printed and rescanned, merged with other documents, stamped by brokers, and exported through aggregation tools, and each step legitimately alters metadata and structure. Every signal in this guide is an invitation to ask a sharper question, not a license to conclude.
A polished bank statement is not proof of authenticity. Unusual metadata is not proof of fraud. Every signal here is a reason to ask a better question—never a verdict.
What a genuine Citi bank statement typically contains
Citi's statement formats vary by product, relationship tier, and era, so read these as traits commonly seen on genuine, portal-downloaded consumer statements rather than as requirements. A reviewer gets more value from testing the document's internal agreement—summary against detail, balances against transactions—than from policing any single layout habit:
- The issuer is typically identified as Citibank, N.A., with Member FDIC language and customer-service contact information presented on the first page.
- The statement period is printed as an explicit date range; billing and statement cycles do not necessarily track calendar months, so a mid-month boundary is not suspicious by itself.
- Statements commonly open with a summary of the relationship or account: beginning balance, total deposits or credits, total withdrawals or debits, and ending balance, sometimes across linked checking and savings.
- Transaction detail typically lists date, description, and amount, and a balance column carried through the activity is commonly present on checking products.
- Descriptions are compact and code-flavored, with recognizable patterns for ACH credits, debit-card purchases, wire activity, and fees.
- Masked account numbers keep one masking convention throughout the document—every page, header, and summary uses the same style.
- A statement pulled from Citi online banking is a text-layer PDF whose contents can be selected and copied; an all-image file indicates a scan or a rebuild and should trigger the stronger-source request below.
Field-level checks anyone can run
1. Get the file from the strongest source
Ask the applicant, where your policy allows, to download the statement from Citi online or mobile banking and send that exact PDF. Every intermediate step—screenshotting, photographing, printing and rescanning—destroys structure these checks rely on. Never ask anyone to share banking credentials.
2. Take a SHA-256 hash immediately
Fingerprint the received file before you do anything else, so your review notes are permanently tied to one specific document. If a different version surfaces later, the hashes will not match. Ocolta's free scanner computes the fingerprint locally without uploading anything.
3. Reconcile the account summary
Beginning balance plus credits minus debits must equal the ending balance, for the account and for any relationship-level totals the Citi statement presents. Perform the addition explicitly and record discrepancies to the cent—an altered transaction frequently leaves a stale summary behind.
4. Chain the balance column line by line
Where the transaction detail carries a balance column, verify at least a full page: each printed balance should equal the previous one adjusted by that line's amount. A break in the chain marks the exact row where a figure stopped agreeing with its neighbors.
5. Validate dates against the stated period
All activity should fall within the printed statement period, in chronological order. If the applicant provided consecutive statements, confirm the months interlock: ending balance to beginning balance, with no missing period in between and no overlap.
6. Reconcile payroll credits with the income story
Direct deposits on the statement should name an employer consistent with the application, land at the claimed cadence, and align with net pay on any pay stubs provided. Deposits that match gross pay exactly, or that skip cycles without explanation, warrant a conversation.
7. Review creator and producer metadata
Check what software the PDF says produced it. A consumer editing or design application in the creator field of a bank statement deserves an explanation, and so does a modification timestamp well after creation on a file that was supposedly downloaded and sent untouched.
8. Search for incremental revision history
PDFs can accumulate embedded prior versions through incremental saves. If a Citi statement offered as a clean download contains multiple internal revisions, that is a strong basis for requiring a fresh original downloaded from the source in front of you or under documented conditions.
9. Put the key figures under 400% zoom
Enlarge the amounts your decision depends on. Edits reveal themselves in small ways: baseline drift, a near-identical but wrong font, spacing that breaks the numeric column's alignment. Use the same digits printed elsewhere on the page as your comparison standard.
10. Confirm identity details are uniform
The customer name, masked account number, and address block should be identical across every page and consistent with the application file. Inconsistent masking or a name rendered differently on one page suggests pages drawn from different documents.
11. Interrogate implausibly tidy activity
A genuine month of spending is irregular. Round-dollar deposits throughout, duplicated rows sharing identical cents, or a balance that hovers just above the required threshold all month are reasons to request a second Citi statement and compare the pattern before relying on the first.
What Ocolta’s free scan checks automatically
Several of the checks above are mechanical, and mechanical work belongs to software. Ocolta’s free bank statement checker runs entirely in your browser—the file never leaves your device—and reports the supported signals it can actually observe: whether the declared file type matches its binary signature, which software the PDF says created and produced it, creation and modification timestamps, incremental revision pointers, embedded scripts or attachments, and a SHA-256 fingerprint of the exact file you reviewed. For statements it also reconciles the summary arithmetic—opening balance plus credits minus debits against the closing balance—and explains benign causes to consider for each observation. The PDF tamper checker runs the structural subset on any PDF. Every result keeps “unable to determine” on the table; the scan never claims a bank statement is authentic or fraudulent.
When to escalate beyond file review
File review sorts documents; it does not settle them. When the stakes are material and questions remain, escalate through an authorized route: a consumer-permissioned account-data connection, a newly downloaded original requested under your written policy, or a documented verification conversation using Citi contact information you located independently—never a number or address printed on the document being questioned. Escalate by the same criteria for every applicant, and involve legal counsel before document findings contribute to an adverse decision.
When the file itself deserves a deeper look before you escalate externally, Ocolta’s AI Deep Review ($5 per document, no subscription) asks a model to organize fraud-risk and AI-generation indicators—evidence locations, confidence, benign explanations, limitations, and next checks. It reports observations, not verdicts, and it can return “unable to determine.” See pricing for 5-review and 25-review packs.
Frequently asked questions
Can Ocolta tell me whether a Citi statement is fake?
No tool can. Ocolta's free scan runs entirely in your browser, checking structure, metadata, revision history, and statement arithmetic, and reports supported observations with an explicit unable-to-determine outcome when the evidence is thin. It never labels a document authentic or fraudulent and never contacts Citi.
What is the fastest first check on a Citi statement?
Summary reconciliation. Beginning balance plus credits minus debits must equal the ending balance, and the balance column should chain correctly from line to line. Two minutes of arithmetic catches careless alterations more reliably than any visual inspection.
Is metadata that looks wrong proof of a forged Citi statement?
No. Honest workflows—printing, rescanning, merging PDFs, exporting from mobile apps, syncing through financial aggregators—all rewrite metadata. An anomaly is a reason to ask for a portal-downloaded original and an explanation, not a finding of fraud.
Will Citibank confirm a statement's authenticity for me?
Treat contact details printed on a submitted statement as unverified—on a forged document they can be fabricated too. Use an authorized verification channel or contact information you obtained independently, apply it uniformly across applicants, and document what you did under your written policy.
Do not tell an applicant that a document is “fake” based on file review alone. State the observation, request the same follow-up your written policy requires in comparable cases, apply consistent criteria to every applicant, and preserve an unable-to-determine outcome. Obtain legal review before using document findings in an adverse decision.