Consumer complaint received 2021-07-07
Company: CITIBANK, N.A.
State: AZ
Product: Credit card or prepaid card
Sub-product: General-purpose credit card or charge card
Issue: Problem with a purchase shown on your statement
Sub-issue: Credit card company isn't resolving a dispute about a purchase on your statement

Complaint:
Our email system at my work was hacked and someone sent me an email from the employer owner account email and pretended to be the owner of the company that I work for. They indicated they were in a meeting and needed me to purchase XXXX XXXX Cards for some of our business partners in the meeting. 

Believing it was the owner, I went to a grocery store ( XXXX XXXX  ) and purchased 11 gift cards at {$200.00} dollars a piece for a total of {$2200.00} on my Citi Mastercard. The exact transactions were made on XXXX. The amounts were as follows : {$200.00}, {$400.00}, {$400.00}, {$400.00}, {$400.00}, {$400.00}, {$400.00}. 

I sent 5 of the gift card codes to the person that was impersonating the owner of my company. Halfway through sending these codes, I decided to stop and check with my boss as it seemed like an unusually high amount. He told me that he believed at that point that we might have been hacked. At that point I didn't send the other 6 codes for the {$1200.00} worth of gift cards. 

At this point, I IMMEDIATELY called Citi and let them know what had happened and asked them to try to cancel the transactions. Unfortunately, instead of simply trying to cancel the transactions -- they didn't try to cancel them because they were more concerned with confirming my identity. 

I had made similar purchases on another credit card ( Visa XXXX XXXX ) and called them after I got off the phone with Citi. They were actually able to cancel 4 of the 5 transactions even though I had called them AFTER I had called Citi. Which leads me to believe Citi could have cancelled some, if not all of the transactions. Also, Visa XXXX XXXX filed a fraud claim report right away. Citi, because they said they couldn't confirm my identity without sending me a letter in the mail -- didn't file my fraud claim report until about 2 weeks later. 

A few hours later, with the help of my employer -- I filed a police report and also an FBI report. The police report number is XXXX. I gave this police report number to Citi and Visa XXXX XXXX. 

Visa XXXX XXXX, said they would not make me responsible for the charge of {$400.00} until they had wrapped up their investigation which they concluded after about 3 weeks. The result was that because of our employer email account being hacked, they weren't hold me liable for the charge. 

On the other hand, Citi Mastercard concluded their investigation in about 6 or 7 days and sent me a letter saying I was liable and that I needed to pay the entire {$2200.00} immediately by the due date for my statement. I had to consult an attorney who told me to call them back and have them reopen the case as it was my legal right. They were reluctant to do so until I told them I would be filing a complaint.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation