Product: Checking or savings account

I received a call from what looked by a Citibank fraud dept. on XX/XX/XXXX. I gave this called no information. They said it looked like I may have fraud on the card and when they mentioned the charges and I said yes that is fraud. They told me to change my password. I told them I would do this directly with Citibank, which I did. I never gave them the new password. The other signer on the account heard the call and came in ( XXXX XXXX the owner of the company ). They said we should check your debit card as well. ( the owner ) never gave them his card number. Instead they said is the last 4 digits XXXX and XXXX confirmed yes. They then proceeded to list the last five debt charges that XXXX had just recently made. XXXX, Office Depot and 2 or 3 others. It was apparent they were already in the account. XXXX confirmed those were valid. They said good that card has not been comprised. The caller then said to me, do you want to also be noticed by text if more fraud ever happens. I said yes. He then said okay, I am going to input that number for that dept. and then hit " add call '' then you will be in the system and you will get those notifications. That unbeknownst to me actually created a call forward. I noticed 2 days later that just under XXXX have been wired out to two different individuals. Apparently what they had done was link an app I have never used to our business account. I did not get a email notifying me of this. Once we discovered this I immediately took my phone to XXXX to have them check for malware, no malware was detected but they did see the call forward. I got a report from XXXX with these findings. When working with our branch office they looked internally at what happened. They said someone tried to do a wire for XXXX, a notation was made that a call to " XXXX ' was made. That wire never happened, what did happen was a wire for XXXX ( no call was made by Citibank for that wire ). The following day another wire for XXXX was made ( again no call was made ). While the phone had been forwarded, I was still receiving and sending texts and I could still make outside calls. I never received the 1 time code for verification from Citibank. I asked the banker how these wires were made while using no token. I have done wires in the past in another account that I have and have never been able to do a wire without a token. They told me with this app you can wire up to XXXX with no token. I was shocked. The wires came out of our XXXX XXXX XXXX XXXX account. This account very rarely ever do wires. Maybe in the last 2 years we have done 2 for XXXX each and always to the same person. I filed a complaint with Citibank, they declined the claim. I said I need to hear the " XXXX '' call that was made and what security questions were asked and they said I have to get a subpoena for this. I did receive a letter in the mail on XX/XX/XXXX dated XX/XX/XXXX ( when this call occurred ) stating that this account was set up with my business debit card. At that point the damage was done. I am shocked that none of this was a flag, to me there were major flags. I am also shocked at no time did the 1 time code for verification ever happen. Citibank is now being sued by the State of New York by the Attorney General stating millions have been lost by their constituents due to lack of strong security systems and Citibank is using a loophole to not reimburse their customers. Something is very wrong here. I should not have to pay for an attorney to get the evidence for this case.