Citibank's Virtual Keyboard

If you go to the Citibank India website, and select the User Name (or Guest) option from the Login as drop-down box, you'll be taken to a new window, where you'll see a login page somewhat like this. In this page, you can enter your 16-digit credit card number using the keyboard, but to enter your Internet password, you have to use the virtual keyboard. Here are the reasons Citibank wants you to use the virtual keyboard.

The Virtual Keyboard is dynamic. The sequence in which the numbers appears will change every time, the page is refreshed. The Virtual Keyboard protects you from malicious 'Spy Ware' and 'Trojan Programs' designed to capture your keystrokes. The Virtual Keyboard eliminates this risk and makes your Citibank login that much safer and provides for a secure online banking experience

Does that provide for a better user experience? Nope. Since the sequence of numbers change every time you login, you have to look for every key in your password. This slows you down to a crawl. And yes, it's much safer, if there's nobody looking around. Otherwise, they possibly can see your monitor and figure out every key that you click, because now you've become so slow. You're driving at 10 kmph in a 50 kmph zone. When you try to click a key, the key is clickable only on the part that has the text, i.e. you can't click anywhere inside the square, you have to click on the text. This slows you down even further. Since you have to click on such a small area, you sometimes miss and the visual feedback (the asterisk (*) in the password text box) is to the left, so you can't be sure if the asterisk came up or not. God help you if you miss one or are not sure; clear the box and do it again. Fun. Then, if you're like me, you finally give up and click the hyperlink that allows you to login using the keyboard. Much better. Citibank should go back to that as the default. Here's one real-life situation where Citibank should've done some usability testing. It would've helped for sure. There's one question that bothers me still though. How come Citibank allows you to enter your user name (account number no less!) using the keyboard and doesn't protect that from spyware programs? Your account number doesn't need protection?