Consumer complaint received 2022-07-20
Product: Checking or savings account — Checking account
Issue: Managing an account — Banking errors
Company: CITIBANK, N.A. (MD)

All, My Citi Bank accounts and Credit Card were hacked on XX/XX/XXXX. 

Ive given my story to several people throughout this process, primarily with : XXXX XXXX, XXXX XXXX, and XXXX XXXX at the Citi XXXX XXXX, XXXX branch XXXX It was with XXXX that we raised issues regarding fraudulent activity on my Citi XXXX XXXX  and helped check-in on other active banking investigations ( XXXX, and XXXX ) into about {$5500.00} worth of fraudulent activity in my XXXX and {$900.00} on my XXXX XXXXXXXX Card. Additionally, I had a conversation with a security representative through XXXX XXXX mentioned above ) where we were told I got hit with a malware attack. I was advised to change all pertinent information regarding my identity ( phone number, passwords, account information, emails etc. ) and to also create a police report and run a security report with XXXX. XXXX and I followed the instructions and created a new account. That day, XXXX XXXX, I received a ~ {$1500.00} paycheck from my employer ( XXXX - $ XXXX ) in XXXX and we needed to move it into the newly created oneXXXX that was attacked shortly later, bringing it up to three total attacks ( XXXX, XXXX, XXXX XXXX XXXX ). 

Additionally, in working with XXXX, we found out a Citi XXXX investigation had not been started after my first contact on XXXX XX/XX/XXXX. The XXXXwo of us sat on the phone for 3 hours starting to make a new one and we did. I followed up the next week and spoke with a Citi Fraud Prevention Team supervisor, XXXX XXXX, who confirmed I had zero active credit card investigations. Confused, enraged and beside myself, I outlined my entire story again, gave all the dates and tribulations again, and demanded an investigation begin. AGAIN! 

The next Citi XXXX # Support hurdle I faced was in the verification process. Ive uploaded my new phone number several times, spoke with Citi Customer Service, Fraud Prevention on both the banking and XXXX side, but everyone keeps sending verification requests to a compromised and inactive phone number ending in XXXX. Its that issue, trying to continue an investigation and using compromised account information, that they rescinded a provisional credit of {$3700.00} because they lost contact with me. My new phone number, in stone to this leadership team, is ( XXXX ) XXXX and has been displayed on my Citi profile for more than two weeks. Why was the investigation team trying to use an old and compromised phone number when it was clearly updated from my side through Citi SupporXXXX on XXXX XXXX? 

From there, things really took a turn, however, what needs to be focused on is not the number of times I was attacked and the ~ {$8000.00} that was jeopardized, but how Citi responded and the lack of support I received from calling into your organizations support line from a customer and Branch seat. 

As a customer in good standing with this organization I feel things should have been better, teams and departments should be held accountable, and tracking your customers data between all departments needs to desperately improve. 

Here is where I believe things went wrong from the Citi side : - The 2nd attack on account ending in XXXX was made under the same, initial, compromised profile/acct ending in XXXX. The hacker was still embedded in XXXX and was able to track my {$1500.00} paycheck on XXXX XXXX and attacked again. XXXX, mentioned above, had helped me earlier that day and brought in the security rep who mentioned it was a XXXX XXXX in the first place. 
- The Citi phone line system is not meant to help you. XXXX and I called into the XXXX number together to begin an investigation. She tracked the XXXX of the folks involved, and nothing was resolved, started, or even noted on my account by the time I spoke with XXXX XXXX, Citi Credit Card Fraud Prevention Supervisor. 
- Everything I did was over the phone, but finally, XXXX XXXX said I need to physically dispute the charges from my side. I never knew that outright nor was told to do it in the beginning. Thankfully, I made a minimum payment of {$35.00} by XXXX XXXX on my new Citi XXXX XXXX XXXX ( prior to an investigation ) but Im still in a bad spot and must suffer with a looming balance of {$230.00} that is still unresolved. 
- Because Citi employees continued to use an old, compromised phone number and didnt see the new changes made on my account, they are rescinding {$3700.00}. Why do I have to suffer and now face a negative account balance for their mistakes? Why does the customer have to suffer? Why cant your team get it right? Because your team members and departments do not have total visibility into my issues and accounts, I am now taking the brute force of this issue. Thats unfair. 
- Citi policy : in a situation like this, tracking information is important. What needs to change, and what went wrong, is the Citi policy regarding XXXX and representative emails. Why cant you hand them out when asked? If I had that information this story would be a lot more involved, and there would be a lot more accountability. 

The overall objective with this email is to highlight a horrific experience Ive had in dealing with Citi bank during this attack. I lost about XXXX, finally had all my monies returned, I got a chance to withdraw, spend, reimburse family members, and now its being taken away again because Citi operations does not have strict standards of accountability. Thats absolute garbage and something I will continue to share with others in my network. 

I will be filing a complaint to CFPB and request all audio recordings from all connections made from my side and Citi XXXX XXXX branch be sent to me in a timely manner. I refuse to request this information through Citi Customer Support # XXXX phone line. 

Thank you and XXXX, XXXX