Because for online payment, your credit number is the "account number" for the credit card, which Citibank just consider it as normal payee. So it displays all the numbers.

So try to keep your citi's password safe.

PS: I think this happens to some other online payment as well, not only citi bank.

By the way, only the cc number is ok, at least the expiration date is not there.