Consumer complaint received 2023-07-21
Company: CITIBANK, N.A.
State: CA
Product: Credit card or prepaid card
Sub-product: General-purpose credit card or charge card
Issue: Problem with a purchase shown on your statement
Sub-issue: Card was charged for something you did not purchase with the card

Complaint:
I am the victim of credit card identity theft. An unknown individual or criminal enterprise obtained access to my Citibank issued credit card number and security code by unknown means. My wife also has a credit card with the same credit card number. The credit card details had been loaded on to our family 's XXXX online e-Wallet and were accessible through our phones, laptop computers and tablet devices. It is quite possible that hackers were able to pierce internet security protocols to steal the credit card details, including security codes and chip data. 

Between XX/XX/2023 and XX/XX/2023, approximately XXXX unauthorized charges were made to my account totaling an estimated amount of {$14000.00}. The bulk of these unauthorized and fraudulent charges were made in the cities of XXXX XXXX, XXXX and XXXX in XXXX XXXX XXXX XXXX, with additional charges in XXXX XXXX XXXX XXXX, XXXX and XXXX XXXX. The types of charges included auto repair, large expenditures at departments stores such as XXXX, XXXX and Best Buy, motel and gas charges, cell phone provider charges and fast food restaurants. My wife and I do not live, work or shop near these towns and had no occasion or reason to do so. 

I was not alerted by Citibank, my credit card issuer, as to a potential fraud warning until XX/XX/2023, after most of the fraudulent charges had been made. I immediately checked my account online, called Citibank 's fraud hotline and identified multiple fraudulent and unauthorized transactions. 

I went through every identified fraudulent and unauthorized charge with Citibank 's team. They agreed to cancel the card, issue me a new card and investigate the matter. However, on XX/XX/2023, Citibank 's security team sent me a letter claiming that there was no fraud and that the charges were payable by me. They claimed that ( a ) since the originally issued cards were in the possession of my wife and me at all times, and ( b ) the credit card 's XXXX chip was used to make the disputed transactions at a chip enabled card reader that no fraud occurred and that I am responsible for the charges. 

There are clear errors in Citibanks reasoning. 

First, credit card data, including security data, is frequently stolen by electronic means, and one does not need physical possession of a credit card to obtain card numbers and use that information to make unauthorized transactions. Card data are now very prone to hacking because they are stored on e-wallets and accessible from several devices, including cell phones, laptops and tablets. 

Second, data obtained from XXXX chips can be cloned and used to create new cards which evade security protocols and fool merchants. Clearly, Citibanks fraud detection service was fooled as several unusual and uncommon transactions from merchants and towns that I have no history of frequenting were made before they recognized a problem with fraud. 

Third, Citibank did a poor job of fraud detection. By their own admission, they did not alert me until well after almost all of the fraudulent transactions had taken place. Had they detected the activity sooner, I would not be facing such a high liability exposure. Citi cant, on the one hand, determine that certain suspicious activity constitutes fraud, cancel a card, replace it, and then, on the other hand, deny that any fraud occurred and force me to absorb the full cost for transactions that I did not authorize. 

It is difficult to have confidence in the financial system when corporations behave in such a duplicitous manner. 

I need the matter properly investigated and I need to be made whole. Citibank should do the right thing and issue me a full, permanent credit for the entirety of the amounts I have disputed. It would be easy for Citi to agree to reimburse me for the transactions that took place between XX/XX/2023 and XX/XX/2023 from the locations and merchants where I have no prior record of doing business. Thank you for your time and attention to this matter.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with monetary relief