http://twitter.com/freerobby/status/12711147469 claims it's a Citi API fail. (Obviously Blippy should be filtering out this sort of stuff, but dubious on Citi's part, too.)

Easy, they don't encode their credit card numbers and are not PCI-compliant.