Consumer complaint received 2021-04-20
Company: CITIBANK, N.A.
State: CA
Product: Checking or savings account
Sub-product: Checking account
Issue: Managing an account
Sub-issue: Problem using a debit or ATM card

Complaint:
Pls see supporting Citi-notarized Affidavit of Unauthorized Online Wire Transfer & attached timeline and documentation. 

Fundamentals : Relevant Citibank Account # XXXX ; Routing XXXX Account Holders : XXXX XXXX XXXX & XXXX XXXX XXXX ( Citi clients 27 years, mostly XXXX XXXX  ) Address : XXXX XXXX  XXXX, XXXX XXXX, CA XXXX ; XXXX ; XXXX XXXX Debit Card : XXXX XXXX XXXX XXXX ( XXXX XXXX ) *We are both CA attorneys ( XXXX XXXX ) ( XXXX XXXX ) XXXX is a professional writer in XXXX XXXX, CA currently ; XXXX is a XXXX XXXX XXXX  to XXXX, XXXX currently. 

Fraud Transpiring on XX/XX/XXXX : {$3900.00} unauthorized transfers paid to " XXXX XXXX '' and/or " XXXX XXXX '' 1 ) XXXX ( {$970.00} ) to XXXX XXXXXXXX Acct # XXXX XXXX ) XXXX ( {$970.00} ) to XXXX  XXXX Acct # XXXX XXXX ) XXXX ( {$970.00} ) to XXXX  XXXX Acct # XXXX XXXX ) XXXX XXXX  Citi Case # XXXX - {$970.00} FBI ic3 CyberCrime Case : Filed XX/XX/XXXX. # pending - waiting for case # by email XXXX  XXXX, CA Police Dept : Report filed XX/XX/XXXX - Case # XXXX Essentially, at XXXX on XX/XX/XXXX, I received a phone call from Citibank 's correct # XXXX from a " fraud specialist. '' The person stated there was suspicious activity on our account and read I believe three recent transactions in correct amount and service provider form the day before XX/XX/XXXX. He recited my address and phone to me and I believe my debit card number 's last 4 digits and inquired about charges for XXXX and XXXX XXXX in XXXX which I stated were not legitimate. He said they would be sending a new card to my address. I've had many calls from Citi Fraud over our 27-year relationship so this all sounded legitimate. No reason to be suspicious given correct phone # and recitation of all my personal and account info to me. In fact, it sounded as though he were in my account and reading all this data to me given the transactions and account info he had. I learned later that Citi exposes and leaves its clients vulnerable to fraud by providing this transaction info through its automated system with nothing more than a phone #. That is not commercially reasonable. 

During this call I provided no personal identification, debit card, or account information, including no customer identification number, personal identification ( pin ) number, SSN, cosigner info, mother 's maiden name, security phrases or passwords, phone or address, or dollar amounts or login info either for online or mobile app ( they already knew those and recited them ). I am 100 % certain of this. The customer id number and personal identification number are the two items required to be given BY ME to effect a commercially reasonable wire transfer under Citi 's own Terms & Conditions. I provided neither of these yet Citi nonetheless ( after giving criminals my account info presumably through its phone system ) somehow allowed 4 HIGHLY UNUSUAL, historically inconsistent XXXX XXXX transactions to initiate and successfully complete from a XXXX XXXX payable to a XXXX XXXX and/or XXXX XXXX in a matter of minutes -- without a single security alert or red flag. We do not send wires nor do we send large sums randomly from our tidy checking account in rapid-fire succession as any cursory review of our account reflects. In 27 or so years I think you could count wires on one hand. Citi has declined transactions in hair salons and donut shops on this account with some frequency - it couldn't catch this kind of bizarre activity? Clearly another security failure. 

I won't regurgitate here the attached timeline of expository, truly remarkable facts that reveal the egregious delay and negligent handling by Citibank and the hours that passed being passed around Citi 's XXXX, XXXX call center, hold times, and multiple agents not knowing what to do XXXX try freezing our account as both my husband and I begged! ) and in some cases refusing to authenticate us or speak to us. Please do read - it is astonishing, really. Suffice it to say, once I saw emails from Citi recording this fraudulent activity in our account I immediately, at XXXX XXXX called Citi and our odyssey of negligence began. I wasn't able to get into my account online or mobile app that day ( consistent with fraud ) but my husband could. He actually in real time watched the wires come in, one at a time ( " Now I see four! " ), and show as " Pending '' as he frantically tried to cancel them and get help from CIti to freeze the account and put a SWIFT hold on the recipient account ( at XXXX  XXXX we later learn ), with me on the other line doing the same. We got nowhere- no one would even connect me to Security/Fraud. It wasn't until approx. XXXX XXXX. that someone in Fraud finally froze our account for me after much back-and-forth authenticating through my daughter 's phone ( kind of odd they allowed that! XXXX. Despite Citi aware of everything and me speaking with XXXX XXXX XXXX and Wire representatives after more long hold times ( and them telling me supervisors weren't available and then the XXXX XXXX  Unit was closed ), Citi knew about these wires and transfers and where they were going and didn't do anything to reach out to XXXX XXXX until a full day and a half later, per XXXX in Escalations on XX/XX/XXXX at XXXX XXXX  Gee, I'm guessing most criminals in the wire game don't wait around that long to move their stolen $ out. It's hardly surprising that XXXX  XXXX denied Citi 's claim that late. Incidentally, it was XXXX  XXXX who helped me learn this information at first - not Citi, whose Wire Unit has been horrific. It took 24 hours to reach someone with authority there - with roughly 9 hours of actual, live hold time! Can you imagine? Even today, when I called simply for the correct fax # for my affidavit, it took 2.5 hours of hold time to connect - for a fax number! Based on my conversation with this XXXX, who decided to label our fraud a " scam '' and tell me Citi does not bear risk for these transactions -we do - Citi played hide the ball with me about the process of recovering our funds and the Affidavit I would need to process to even initiate the process with its Incident Reporting Unit. it was only when I pushed today and said I was considering filing this complaint that she was more forthcoming about the process. She tried to blame the branch for not having the info but she did let slip that they don't give this information out freely. It's really remarkable. I am happy to provide any further details warranted. I've left a lot out here. It was a very chaotic, upsetting, distressing situation that prompted unprecedented emotion in me, much of it directly flowing from what Citibank put us through for hours just to try and freeze our account and try to contact XXXX  XXXX, much less exposing us in the first place with its lax security mechanisms. I can't imagine many depositors appreciate how vulnerable they really are. I still don't know if my phone has been hacked or if online/mobile app banking is safe at this juncture for me.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation