Consumer complaint received 2025-12-30 00:00:00
Product: Checking or savings account — Checking account
Issue: Managing an account — Problem using a debit or ATM card
Company: CITIBANK, N.A.
State: NY

Complaint narrative:
FRAUDULENT DEBIT CARD CHARGES AND SYSTEMIC FRAUD DETECTION FAILURE FRAUD TIMELINE : XX/XX/2024, XXXX : Four identical unauthorized charges of {$76.00} each posted within 4 minutes from " XXXX XXXX XXXXXXXX XXXX XXXX  XXXX NY XXXX XXXX All were card-not-present transactions. No fraud alerts sent. 

XX/XX/2024 : One unauthorized test charge of {$0.00} from " XXXX XXXX XXXX. '' No fraud alert. 

XX/XX/2024 : Six identical unauthorized charges of {$48.00} each from " XXXXXXXX XXXX XXXX XXXX XXXX XXXXXXXX '' ( XXXXXXXX XXXX XXXX  payment processor ) posted within minutes. No fraud alerts sent. 

I discovered the fraud by manually checking my account. Total initial fraud : approximately {$600.00}. The bank refunded these charges. 

XX/XX/2024 : I reported the fraud. The bank stated a new card would be mailed. 

Week of XX/XX/2024 : I received a " replacement '' card with the SAME card number, only the CVV changed. This does not stop e-wallet fraud because the fraudster 's system still has the card number stored. 

XX/XX/2024 : THREE new unauthorized charges of {$98.00} each from XXXX ( " XXXXXXXX XXXX XXXX XXXX XXXXXXXX XXXX '' ), totaling {$290.00}. I called again. The representative said the charges were from my debit card stored in an e-wallet, specifically XXXX XXXX. I checked my XXXX XXXX immediatelymy debit card was NOT there, only my credit card. This means either the fraudster added my card to their own wallet, or the bank 's information was incorrect. 

Only then did the bank issue a card with a NEW card number. These three charges have NOT been refunded yet. 

Total fraud : approximately {$890.00} across 13 unauthorized transactions ( only the XX/XX/XXXX charges of {$290.00} remain unrefunded ). 

FRAUD DETECTION FAILURES : 1. Duplicate transaction detection failed : Four identical {$76.00} charges in 4 minutes, six identical {$48.00} charges, and three identical {$98.00} charges should have been automatically blocked. 

2. Zero real-time alerts : No SMS, push notifications, or emails for any of the 13 fraudulent transactions. 

3. Geographic anomaly detection failed : Charges from XXXX with no travel notice or history of international transactions. 

4. Velocity controls failed : Over {$600.00} in unusual charges within 5 days with no spending limits triggered. 

5. E-wallet monitoring failed : Bank claims card was in XXXX XXXX but never alerted me when card was allegedly added to a wallet I don't control. 

IMPROPER CARD REISSUANCE : Reissuing a card with the same number is ineffective for card-not-present and e-wallet fraud. When a card is stored in an e-wallet, changing only the CVV doesn't help because the token/card number remains valid. The {$290.00} in charges on XX/XX/XXXX were entirely preventable if a new card number had been issued initially when I first reported fraud on XX/XX/XXXX.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with monetary relief