Consumer complaint received 2022-08-06 00:00:00
Product: Checking or savings account — Checking account
Issue: Managing an account — Problem using a debit or ATM card
Company: CITIBANK, N.A.
State: CA

Complaint narrative:
Based on 7 documented phone calls and text, I can show evidence that Citibank is in violation of The Federal Electronic Fund Transfer Act, specifically as it relates to Regulation E which covers these types of activities. 

I hereby dispute the XXXX for {$2700.00} unauthorized XXXX transfer to a XXXX XXXX and XXXX unauthorized purchase for {$240.00} XXXX XXXX XXXX XXXX XXXXXXXX XXXX  XXXX 

I will challenge and pursue in every possible and legitimate manner as a consumer with protection rights under the Code of Federal regulations CFR. 

Timelines and facts for the case : XX/XX/2022 XXXX PM ( XXXX XXXX EST ) XXXX Fraudulent charge to XXXX XXXX ( per bank statement ) See Debit card ( XXXX ) purchase by phone. Later the Service Rep from Citi bank informed me they had also gotten ahold of my ATM pin from hacking into my Citi bank account! 

XXXX ( XXXXXXXX XXXX EST ) Fraudulent withdrawal to XXXX {$2700.00} XXXX XXXX PAY ID : XXXX ORG ID : XXXX NAME : XXXX XXXX. A national search of all data bases has no record of this individual. I have a friend in the Federal Government who is checking their data bases and found nothing on this individual. Clearly a fraud. 

XXXXXXXX XXXX received text message from CitiBank. I replied No They obviously got my last 4 digits right. 



XXXX XXXX  answered call from Online Bnkg. Citi Bank fraud representative investigating fraud charges. Call lasted for 14 minutes. The number checks out to be a Citi Bank legitimate number. This was obviously a follow up to the above text. Either it is a legitimate Citi bank employee or someone impersonating an Citibank employee. If not a Citibank employee, they were able to hack into the Citibank number and reroute it to their number for this particular call. 

o Before I answered any questions, I asked them to verify they were from Citibank : They replied with my last 4 digits of SS, my birthday, my address, amount they I had in the bank and last 4 transections. They even had my ATM pin which they said was used for the XXXX XXXX Fraudulent transection. This sounded strange because I am told no Citi employee has access to my pin? 
o Towards the end of the conversation, they also mentioned the XXXX fraud and were trying to put a stop to it and wanted to verify that they were talking with me XXXX XXXX. 
o I got suspicious with that question and hung up, saying let me call Citibank directly back. 
o I called the above number XXXX and it appeared to be legitimate. ( Somehow the fraudster has hacked this Citibank number? Or this is really a legitimate Citi Bank number. ) XXXX, I called XXXX ( Citi XXXX number from back of Debit Card ). After explaining my problem they told me to call XXXX to report it. 



XXXX I called the number XXXX as told, They said they would text message me for verification. We spent over 18 minutes discussing my case. They then said they would send me a text. 


XXXX Citi Sent me a text message for verification XXXX got an incoming call back from Citibank ( XXXX. By now I was so confused and concerned wondering what is the real CitiBank number and or who is fraudster impersonating CitiBank. The person on the phone wanted to review my case all over again and in detail. The call lasted over 28 minutes. After I explained my situation all over again, I was told not to worry as a dispute had been filed and if it was fraudulent, I was to get my money back. 

XXXX called back XXXX XXXX XXXX ( number from the back of my card ). Wanted to conform that this was being investigated. This is the only number now that I trust. Citibank confirmed that my case was already under investigation. 





Based on the above : Citi will have to prove beyond a reasonable doubt that the call at XXXX from XXXX ( XXXX XXXX XXXX ) was not a legitimate Citibank number. If it is a legitimate number, at XXXX I had a discussion with a Citibank Fraud Rep. who said I was hit by 2 Fraud Charges, the XXXX XXXX and XXXX. In that case please send me a copy of the recording for that time stamp. If it is your number then this conversations was recorded. If it was not a legitimate Citibank number it further validates that Citibank was hit by a hacker who was impersonating the bank and using a Citibank phone number as cover while actually calling from a different fraudulent number! 
The recording will verify that CITI bank knew at XXXX that I had fraudulently been hacked. Citi would have had the time to put a stop to the fraud that took place 14 minutes later. Whatever the case may be, whether it was or was not a Citibank representative, this is in violation of CFR. 
I was on the phone with a Citi Bank Fraud Rep from XXXX for 14 minutes ending at XXXX. This was exactly the time when Citibank recorded the posting of the XXXX withdrawal. It would have been impossible for me to make the transaction while I was on the call with Citibank. Also, since the transaction had to go through XXXX ( XXXXXXXX XXXX XXXX, there would have to had been a time delay. It takes 5-10 minutes for a XXXX transection to go through. It was in this span of 14 minutes that the transection must have taken place. This verifies the fact that towards the end of the call the Citi rep informed me that there was a XXXX fraud. Thus a ticket was opened on the case. Citi bank knew about the fraud during the time of our call. There is no way I could have approved it personally or via text to authorize this transaction. Another Violation of the CFR Citi bank sometime on the evening of XX/XX/XXXX refunded the Dispute Number : XXXX Unauthorized purchase for {$240.00} XXXX XXXX XXXX XXXX XXXX Fl XXXX They admit and acknowledge that this was fraud by this action. 

It is not just a coincidence that 32 minutes later the XXXX fraud was committed. Citi Bank did not take responsibility for it. Instead, they point the finger at me. That somehow miraculously I was able to pull this off during the time of the phone call. CITI Bank admits that this was a fraudulent transection. However, Citi still denies that the next XXXX transection was not fraudulent. As an aside, no letter or explanation has been given to me or notifying me of the removal of the XXXX XXXX  charges as of XX/XX/2022 XXXX XXXX I find it quite strange that Citi will go to great lengths and post on my on line account that this XXXX fraudulent activity was denied, but made no mention at all of acknowledging the XXXX XXXX Fraud and not placing a letter in my online account portal about the XXXXXXXX issue. 

All of the factors and indicators point to treachery which is a violation of CFR. It seems Citi simply wanted to reimburse the lesser amount but did not want to admit its wrongdoing for the XXXX issue. This is totally an unacceptable ploy and unfair process on Citis part. It is a blatant violation of Regulation E. 

I have no record, no documentation, no phone calls or IP address made to this XXXX XXXX. An IT forensic audit will not be able to show a data trail from me. Instead if we request a forensic audit of Citibanks data, it will show the trail directly from Citi to XXXX XXXX XXXX. XXXX XXXX that was made by treacherous fraudster which Citi will not admit. Obviously, Citi bank has vulnerabilities in their IT security if the fraudster was able to articulate to me all my confidential banking information stored with Citi. It is common knowledge that Citi has been having fraud problems with this issue and their security process and procedure is not safe from hackers. Over and over again, my historical facts on this issue shows that this transaction was fraudulent and in violation of XXXXegulation E My seven documented phone calls and text, show that my case is a proven fraudulent transaction. 

Fraudulent transactions are covered by Regulation E. Regulation E, part of the federal Electronic Fund Transfer Act, requires banks to refund consumers for fraudulent transactions on their accounts. There is enough evidence to show that treachery was involved. The Consumer Financial Protection Bureau put out a directive in XXXX, saying the law applies " if a third party fraudulently induces a consumer into sharing account access information. '' Citi Bank Online credentials were required to perform these transfers, and the activity appears to be consistent with your normal banking activities this are the direct quotes as reason for denial of the dispute on Citibanks letter sent to me. 
My Credentials on Citis data centers were obtained by treachery methods and means. There is enough evidence in the above to show that. To have Citi deny this dispute is absolutely egregious and in violation of the Federal Law.

Regulation E lets you dispute the following types of errors : Unauthorized electronic funds transfers. Incorrect electronic funds transfers to or from your account. Omission of an electronic funds transfer from your bank statement ( Section 205.2 ( k ) ). Unauthorized electronic fund transfer is an EFT from a consumer 's account initiated by a person other than the consumer without authority to initiate the transfer and from which the consumer receives no benefit. 

Citi also states that my activity appears to be consistent with your normal banking activities. 
There is nothing consistent here. I did not permit nor acknowledged to have this transfer go through with XXXX. I dont know this person. There are no records, digitally or otherwise that shows I have a connection with XXXX XXXX. Citibank just pulled out that verbiage from their stock answer and sent it to me. 

Citibank rep said, it was a XXXX problem over the phone. 
Citi tried to put the blame on XXXX. 
Does the Electronic Funds Transfer Act ( EFTA ) and Regulation E cover XXXX transactions? 
Yes, XXXX transactions are covered by the EFTA and Regulation E. 

What happens, then, if the consumer was tricked or forced into furnishing such access? There is an argument based on the plain language of Regulation E that since the consumer has " furnished the access device '' to the third party, the transaction may not qualify as an unauthorized EFT. 
However, the official interpretation of Regulation E provides the contrary answeran unauthorized EFT10 includes any transfer initiated by a person who obtained an access device through fraud, robbery, or force.11 Comment from CFR Comment 1005.2 ( m ) -3 and 1005.2 ( m ) -4. ( CFR.. CODE OF FEDRAL REGULATIONS ) The timing and sequence of events back-to-back as delineated above, clearly indicates fraud and treachery. 
The CPFB 's recent guidance affirms and clarifies this approach, noting that if a consumer is fraudulently induced into sharing account access with a third party, the subsequent transfer is an unauthorized EFT. This includes commonplace examples of digital fraud, including instances where a consumer receives a call from someone pretending to be a representative from the consumer 's financial institution, as well as phishing or other methods to gain access to a consumer 's computer and obtain such information. 
The CFPB made clear that a consumer is entitled to receive the liability protections of Regulation XXXX, even if that consumer acted negligently. While there is a cogent argument that consumers should bear some responsibility for their actions, the official interpretation of Regulation E expressly provides that negligence by a consumer can not be used as the basis for imposing greater liability than is permissible under Regulation E.12 See Comment 1005.6 ( b ) -2. CFR The interpretation notes that even consumer behavior that constitutes negligence under state law, including writing the PIN on a debit card or on a piece of paper kept with the card, does not affect the consumer 's liability for unauthorized EFTs. 
For the record, I must state that I am a XXXX XXXX retiree. Recently, I have had XXXX XXXX XXXX followed by a XXXXXXXX XXXXt, XXXX XXXX XXXX XXXX XXXX XXXX, XXXX XXXX XXXXXXXX and XXXX XXXX XXXX. I must take expensive XXXX XXXX daily for the rest of my life. These are very expensive. The above monies that Citibank refuses to take responsibility for are monies saved to pay for these XXXX. To miss even a XXXX a day will lead to XXXX XXXX  conditions and XXXX. Thus, the urgency for a quick resolution to this dispute.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with monetary relief