Citibank was hacked by altering URLs

from the Inquirer
By Dean Wilson THE HACKING of Citibank that led to the exposure of 360000
customers’ credit card details was made by simply altering the bank’s URL.
When users log into the Citi Account Online system the URL changes to
include a series of numbers …
http://www.theinquirer.net/inquirer/news/2079431/citibank-hacked-altering-urls