Consumer complaint received 2023-06-07
Company: CITIBANK, N.A.
State: IL
Product: Credit card or prepaid card
Sub-product: General-purpose credit card or charge card
Issue: Other features, terms, or problems
Sub-issue: Other problem

Complaint:
SUMMARY : - 1 ) My credit card account was hacked or compromised in apparently due to a failure of security in CITI 's database ; 2 ) resulting in at least 2 but likely more, fraudulent transactions using my account ; 3 ) resulting, apparently, in CITI replacing my actual account billing address with a fraudulent address in their database, and CITI sending that fraudulent address to XXXX, which caused my actual address to be replaced with the fraudulent address in the credit bureaus ' databases, that spreads the fraudulent information harming me further ; The fraudulent address that CITI allowed in their database likely resulted in CITI sending my statement, and any replacement card ( s ) to the fraudulent address.

4 ) I made multiple attempts to resolve these issues with CITI by phone. I got numerous promises from CITI that were not kept including the following ; A ) multiple unfulfilled promises to send me replacement cards for the account ; B ) multiple unfulfilled promises to send me my account statement so I could pay legitimate charges I made, to get any fraudulent charges removed, and avoid any late charges. 
C ) promises to correct any damage to my credit standing that might occur since I am unable to pay the correct, valid amount without the statement ; D ) an apparent promise on one call was made that the agent was removing the fraudulent account address, and restoring the my correct address as we spoke during the call, which seems not to have been true ; E ) multiple unfulfilled promises that CITI would contact me at my correct account address and / or phone number within a specific number of days ( much later, after, several weeks, well after the promised contact periods had expired, and the promise therefore violated, I started to receive robo calls asking me to contact CITI ) ; F ) numerous promises to resolve all the issues without cost, further risk to my identity, account, personal information, or damage to my credit standing with the the credit agencies, as, for example, the promises made in my XX/XX/XXXX call detailed in the call history section below. 

5 ) Numerous difficulties in communicating by telephone with CITI. Some examples follow ; A ) highly erratic audio quality. Sometimes I could hear and be heard clearly, but many times, the calls were nearly unintelligible, with me not being able to hear clearly, audible gaps in speech sometimes in the middle of words, hiss on top of the agents voice, the agent apparently was not being able to hear me, as the agent would continue speaking over me when I would loudly and repeatedly asking for clarification ; B ) being put on hold for a lengthy period after which the call dropped and went to busy tone. 

TIME SEQUENCE OF CALLS WITH SOME DETAIL XX/XX/XXXX, my wife experienced a credit card refusal. 
____________________________________ XX/XX/XXXX I called the CITI to ask what was going on. 
- I was told there had been 2 physical card transactions, XXXX & Best Buy, one for {$500.00}. 
- These transactions were not done by either legitimate cardholder and therefore are fraudulent, and I informed the agent of that fact. 
- At first, I was told that these fraudulent transactions occurred on XX/XX/XXXX, but the agent later changed the story and said the fraudulent transactions had occurred on either XX/XX/XXXX or XX/XX/XXXX ( my notes are unclear on this point, but the fact remains that I was told 2 different things and the agent seemed a bit uncertain about this point ). 
- I was told the current card account number would be shut down and new cards with new a new account number would be sent to me at my billing address arriving in 7-10 days. 
___________________________________________ About XX/XX/XXXX - I received an email alert message from XXXX XXXX, a security service I pay, and I logged in. 
- Their web site said they had detected that XXXX on XX/XX/XXXX had received an address change for me from 'one of my credit companies. ' As the credit card I am making this report about was the only one I had open, XXXX was being told by CITI in this report that my address had changed. 
- The fact is that I have been living at my current billing address for over 30 years, and have not moved, so the new address entered with XXXX is fraudulent. That fraudulent address, replacing my actual legal current address, apparently entered by CITI, per XXXXXXXX XXXX is : XXXX XXXX XXXX XXXX XXXX, WA XXXX- This implies that either : - 1 ) the CITI database had been hacked and fraudulent data entered. As it would seem unlikely that only my data would be hacked, this would appear that most likely I am only one victim of may whose accounts would be compromised. 
- 2 ) someone had impersonated me sufficiently well to the CITI so as to convince them that it was me and allow them to fraudulently put in fraud data into my account with them. 
_________________________________________ XX/XX/XXXX I called back to inquire as I had not received the replacement cards that I was promised. 
- The agent seemed to say that replacement cards were sent on XX/XX/XXXX, which, I believe would be an error, as this would have been before I had noticed any problem, but it this is true, the cards were likely sent to the fraudulent address, and would be in the hands of the fraudsters, putting me, my identity, and my credit standing at risk through no fault of my own. 
- I pointed out that I had not received my most recent statement yet and it was probably over a week over due, and that I need it in order to pay, avoid late charges, get fraudulent transactions removed. I pointed out that the statement likely was sent to the fraudulent address and the CITI was revealing, to fraudsters, private identity infromation as, for example, entities I was paying, and the amounts I paid, which could be used in further financial attacks against me. 
- The agent seemed to say she removed the fraudulent address and corrected it to my actual address, but this seems not to have been true, as subsequent events seem to show. 
- I asked the replacement cards be expedited, along with my missing statement, and the agent, per my notes, promised that the replacement cards would arrive in 24 to 48 hours. 
- I emphasized that, since CITI had allowd a fraudulent address, - A ) CITI seemingly had been hacked, putting me and my personal data at risk ; - B ) charges made on any charges made using replacement cards they sent to the fraudsters would be fraudulent. 
- The agent kept putting me off when I asked questions., saying, " Don't worry about it, '' or the equivalent, - This particular call had a bad connection and there was a need for a lot of repeating. 
___________________________________________ XX/XX/XXXX I had not received the replacement cards nor the missing statement, so I called again. 
- This time, contrary to the apparent statement by the person I talked to on the XX/XX/XXXX call that the fraudulent address had been corrected to my actual account address while I was on the phone with speaking to that person, I was now told that the address had not been corrected, that what I had been told was not true, and they would need to send me a text message. As the phone number CITI has is an old land line that is not capable of receiving texts, that would of course not be possible. I got transferred to another agent who soon started saying he would not give me, " any further information, '' and kept, I believed used this phrase or something very similar as I asked questions. He refused to tell me how they would contact me, given that CITI had a fraudulent address, and perhaps a fraudulent phone number, and perhaps other fraudulent personal ID for me. 
- I explained that the phone I was calling from is the long-time phone number that they had for my account and that my account mailing address had been unchanged for over 30 years. He kept repeating the phrase about " no more information. '' - I pointed out that CITI using the fraudulent address I had repeatedly flagged to CITI would be CITI knowingly, sending replacement cards, and my statements to fraudsters, putting my identity, personal information about companies I use my credit card for, and my credit standing at risk. As well using a fraudent address puts CITI at risk of allowing fraudlent charges and damaging me, their customer. I emphasized that CITI must not do that, and must remove the fraudulent data, as they had known about the problem for over 2 weeks. There CITI had not resolve the problems, in spite of my efforts to help them over multiple calls. 
- I asked when I could expect a response. 
- He asked about security validation, and I offered to answer the stock security questions that the CITI had requested from me that had been entered online for my account years ago, that would be in the data for my account with CITI. I have those saved in an encrypted file and could pull those up for him, but he ignored me. 
- He repeated himself often. 
- I offered another piece of data he could use to validate me -- the last 6 digits of the checking account number that I always use to make payments on the account -- and pointed out that the agents I spoke to on XX/XX/XXXX and XX/XX/XXXX had asked for that information, and had used that information as validation, but he refused. That is an inconsistency from call-to-call. 
- He asked for a cell number, and I pointed out that I had had an identity problem that affected my credit card with CITI approximately 21 years ago that was reported to the U.S. Secret Service, who told me in no uncertain terms to not give my cell phone number out under any but the most dire circumstances. I was particularly concerned about giving that number to CITI, as CITI 's database for my account obviously was not being properly secured, and had been compromised, and CITI likely was communicating with the fraudsters at a fraudulent address as far as I could tell. Therefore, any new personal data I give CITI is at risk of falling to the hands of fraudsers, unacceptably increasing the risk of fraudsters using my data to attack my other financial accounts. 
___________________________________________ XX/XX/XXXX I called the CITI again to check on status. 
- I went over the history with the agent and expressed my concerns that they were potentially communicating with fraudsters, that their database apparently contained at least a fraudulent address for my account, and perhaps more fraudulent data and transactions. I was transferred to the fraud department. 
- I was told by the fraud department that I would be contacted ASAP by phone or mail. I pointed out that, as their database for the account was compromised and apparently contained fraudulent information, that it was essential that they contact me at my correct billing address or my correct account phone number. I had been advised by XXXXXXXX XXXX, the financial security firm I engage, when they opened a security breach case for the fraud on my credit card account, I was told to insist that I talk to a supervisor. 
- The supervisor I was connected to said that I would be contacted in the next week or so by phone or mail at my actual account billing address, and that they would not use the fraudulent address. 
- I was told that the missing billing statement could not be sent until after the account was 're-certified ' ( I didn't get the exact wording she used in my notes ). 
- It is my clear understanding that I was promised that CITI would correct any late fees, fraudulent transactions, corrections to data reporting fraudulent data and transactions that the CITI incorrectly sent to credit agencies without harm to my credit rating, and any other actions CITI needed to take to 'make me whole ' in terms of money and credit standing at that point. 
- The supervisor said she would open a complaint, which I took as to be what I would consider as a 'trouble ticket ' in CITI 's system to track the unacceptable mishandling by CITI of my situation over time, including to get the issues with CITI making repeated unkept promises, and telling me inconsistent and contradictory things over the sequence of calls, including the often terrible phone connections. Included in the 'compaint ' would be a call during which I was put on hold and after a long delay, being disconnect. 

XX/XX/XXXX Someone left messages on the home phone to contact CITI. 
I called twice, as my first call was disconnected before it was completed. 
First call : I said I expected that this call is being recorded and my entire statement will be entered into the records. He agreed that what I said would be entered in the records. 

I asked for a call reference number. I was told that one would be generated and that he would give it to me at the end of the call. 

He asked for the reason for my call. I read him a summary of problems that are at the beginning of this document. I skipped to the section in this document of What would be a fair resolution to this issue? that begins later in this document. The call was disconnected while I was reading. 

Second call as the first call was disconnected in progress, I tried again : My notes on this call are not entirely clear. 
Ultimately, perhaps after a few transfers, I asked for the fraud department and was transferred.

Somewhere is this process, I asked again for a call reference number, and was told there was not call reference number. I pointed out that this statement contradicts what I had just been told on the earlier call. This is another small example of me having received contradictory information by phone from CITI.

I believe somewhere in here I was asked how I found out about this. I had mentioned that several robo calls were on my home answering machines asking me to contact CITI. In a more detailed explanation of how the would set of issues came to my attention, I started reading the Time Sequence of Calls section above in this document and got to the XX/XX/XXXX call section. I asked if that was enough and was told that was the case. 
I explained that I have been repeatedly promised things by phone that never happened. I explained that I was told things by phone that were contradictory. I explained that my calls have been disconnected, including one earlier today. 
I explained that, therefore I don't see the value of talking. I've talked to multiple people from CITI over numerous calls before, over a period of over 1.5 months, and got the unkept promises, contradictory statements, and call connection problems ( which I detail elsewhere in this documnent ), and that I must get an address to communicate with CITI that will get me a clear, consistent written response to the issues. 
I was given a mailing address, which turns out to be the same as the address on my card statement. The agent seemed to agree that I CITI would respond in writing. 
I was told that I would get, if I understood correctly, a Citi Bank notification by mail. 

I emphasised again that they had been hacke, fraudent data enterd and reported to credit bureaus. 
I emphasised that CITI must report this breach to any overseeing regulatory agencies and law enforcement. I've been hurt by this. It has dragged on for over 1.5 months. 
I emphasised that I need specific information as to resolution proceedures in writing. 
Earlier she said she had opened a complain, but would not share the complaint number. This seems to be a likely contradicion, as on an earler call, an agent told me they were opening a complaint, so why would this agent now a complaint was already open? 
XX/XX/XXXX later in the day I answered a call from someone claiming to be from CITI.

She asked for identifying information from me, and I explained that I had been informed by the U.S. Secret Service to NOT give any information over the phone, not even my name, to someone I don't know, without having some proof that they were who they say they are, as bad guys often call and pretend to be someone else to try to fool people into giving them personal information they can use for fraud. So, I asked her to give me some definitive, uncontestable proof that she was who she claimed she was. She said she understood what I was saying but was unwilling to prove her identity. 
She started asking question even though I had just told her the U.S. Secret Service had warned me not to answer anything without being certain of who was calling. She started talking about me receiving some mail. I pointed out that if she was legitimately who she claimed, she would know that no mail of the kind she described had been sent here and that fact undermined her credibility. She said she could not answer for my mail deliver. I tried to point out that it is not credible to me that, if they sent something to the correct address that the US Postal Service did not deliver it. After some back and forth where she seemed not to respond to my points, she somewhat politely broke off the call.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation