Consumer complaint received 2018-10-30 00:00:00
Product: Money transfer, virtual currency, or money service — Domestic (US) money transfer
Issue: Other transaction problem — 
Company: CITIBANK, N.A.
State: NY

Complaint narrative:
On XX/XX/2018 i reported 3 unauthorized transactions from my Citibank savings and checking accounts for the total amount of {$20000.00} occurred on XX/XX/2018 and XX/XX/2018. Since then for 2 and a half months Citibank was not able to resolve the problem and return my money. I put a complaint on Citibank where i described in details the security failures and violation of dual factor authentication protocol. 
On XX/XX/2018 i received the answer to my complaint. 
Citibank still denies my claim based on : " Upon review, it was found on a call recording that occurred on XX/XX/2018, that you informed us that you allowed a third party to remote access into your personal device. Once the third party had access, your device was used to log into your Citibank account online and the third party initiated the wire transfers. It was determined that no notifications were issued as the device and IP address were consistent with prior use. As such, we must respectfully decline your request for reimbursement. '' First of all i never said that i allowed anybody to remotely access my computer. This is not true. Transcript of the recorded conversation will prove it. 
All i said that if according to Citibank findings my IP was in use for the transaction, means that the computer was hacked and through remote access criminals were able to steal my money without me knowing about it. Citibank says something absolutely different that i was not hacked but allowed hackers to use my IP and to steal money from the bank accounts.

Citibank also agreed that notifications were not issued since the device and IP were consistent with prior use.

I spoke with 3 different Customer Service representatives : XXXX - XX/XX/2018 XXXX - XX/XX/2018 XXXX - XX/XX/2018 All three said that there is a certain procedure or duo factor authentication protocol to initiate a Money Wire. It was confirmed that this is mandatory security procedure for every transaction regardless of home computer or any other device is being used. 
According to the representatives bank must send one time passcode through SMS or through a phone call or if there is no access to the cell phone customer should call Customer Service Center and answer certain security questions. 
XXXX also said that in my case should've been at least one red flag for the suspicious activity on my account since i never used Money Wire for 23 years and also because this is a very high risk transaction because criminals could steal all customer 's money. 
Based on the information i provided, XXXX recommended to appeal the decision previously made by Citibank. 
It's quite obvious to check not only IP and the device but also verify that the account holder is sending {$20000.00}, not anybody else who somehow obtained access to customer 's computer, and I don't understand why this simple procedure was not done on XX/XX/2018. 
It seems Citibank instead of taking care of their security loopholes is trying to make the customer responsible for all the defaults. 
Criminals are aware of these loopholes and will continue stealing more and more money until appropriate security measures will go into effect. 
Once again i completely disagree with my bank response to my complaint and my problem. 
I am a victim of very serious and sophisticated internet crime. I reported it to XXXXPD and FBI IC3 Unit. New York DA Office is also investigating the case. 
Under penalty of perjury i declare that i never gave any permission, authorization or allowed anybody access to my computer and my personal information. I do not know any person to whom my money was sent through these unauthorized money wire transactions. 
I expect my claim to be approved and request a complete reimbursement of {$20000.00} ASAP. 
Sincerely, XXXX XXXX.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation