From a purely technical perspective, I think you re safe. This is based on the fact that the call button is within Citi's own secure mobile app. Although this is the first I have heard of it, It does sound plausible. I would still call them to verify this verification process.
UPDATE: Sounds normal for them. Thread from last year.
I had a similar experience with my Wells Fargo Propel. Had a text message from a strange number regarding a fraudulent charge. Rather than replying to the message, I called the number on the back of my credit card. Thus, I would agree with others that you should call the number of the back of the card. Better to be safe than sorry,
UPDATE: Called the number on the back of my card and told the rep what had happened. Even the rep told me he never heard it before. I asked if he could connect me to fraud department, which he could not and gave me a number to their department (which was same # mobile app provided me with) Called that number and spoke w rep at fraud department if verifying my identity w other bank credit card was normal, she proceeded to say that, that is indeed one way to verify my identity. rest assured, It was not a scam.
Thanks everyone for their advice.
Another side story, (w same rep) asked her to leave a note or something on my account to not decline me for any transaction in Europe as I will be travelling there in few days. She put me on hold and came back and asked for my phone number so she can call back and verify it within 20 to 30 secs. it has been several minutes now and no call backs... what is going on?
Just call back in about an hour.
did call back and used different phone # and did confirm w them. everything is solved.
Its funny how my new # does not get any SMS Alert or call backs from banks and other online account. Shall talk to carrier soon.
Speaking of scammers, I have fun with them. I would get calls from a caller with a foreign accent asking if I want to transfer a balance to a loan at 6.99%. I say, sure! They ask for my credit card number and I give them a number with the same 6 starting numbers. After a while, 5 to even 15 minutes on the phone, they realize it isn't going to happen. They'd ask me what type of card, and I tell them it's a DC card. The first 6 digits match the card type and so they think I'm legit. Eventually, they hang up on me.
I called back, and they answered. I told them, congratulations, you have won a trip for 4 to Steubenville, Ohio!!! Press 1 to accept the prize, 2 to decline. They hang up. Called back probably 8 more times immediately. Hang ups pretty quickly, until they blocked my number. I guess I won't hear from them anymore.