Consumer complaint received 2026-04-15 00:00:00
Product: Checking or savings account — Savings account
Issue: Managing an account — Deposits and withdrawals
Company: CITIBANK, N.A.
State: MA

Complaint narrative:
I am filing this complaint against Citibank, with corporate offices located at XXXX XXXX XXXX XXXX XXXX XXXX XXXXXXXX. On XX/XX/year>, Citibank made XXXX unauthorized withdrawals of funds from my on-line Citi savings account and sent my money elsewhere. The XXXX withdrawals totaled {$38000.00}. On XX/XX/XXXX, Citi notified me that it was denying my claim for reimbursement ( Claim Number XXXX ). Please allow me to provide more detail. On the morning of XX/XX/XXXX, while I was working at my computer, a message flashed up on my screen stating that a withdrawal had been made from my Citi account. The message was fleeting and lasted only a few seconds and did not remain on my computer. As I had not initiated or requested any withdrawal, I immediately called Citi. A Citi representative told me there was no problem and nothing to worry about. Just a few hours later, around XXXX, I was back at my computer and noticed an email from Citi that had been sent to me a few minutes earlier, at XXXX. This message remained on my gmail register and read in pertinent part : CONFIRMATION The hold on your transfer was removed. Thanks for providing us with the information required to verify the following wire transfer from your SAVINGS account. The email reported a withdrawal from my account of {$19000.00}. Alarmed, I once again called Citi. I was eventually transferred to the Wire Department. At that point, l learned that contrary to what I had earlier been told by Citi, there had in fact been a withdrawal earlier in the morning in the amount of {$19000.00}. This withdrawal was in addition to the second withdrawal referenced in XXXX XXXX email. In other words, XXXX separate withdrawals of funds from my Citi account had occurred. Combined, these XXXX withdrawals totaled {$38000.00}, not counting wire transfer fees charged to my account.. I emphasize that I did not request either of these withdrawals. I did not initiate either of these withdrawals. I did not authorize either of these withdrawals. And I did not approve either of these withdrawals. Nor had I provided Citi with any information relating to account verification or otherwise. Nor, to the best of my knowledge, did I receive any prior notification from Citi that the withdrawals were being made. That Citi could allow not XXXX, but XXXX, unauthorized withdrawals from my account on the same day and just a few hours apart evidences a deeply flawed Citi security system. Further, I believe that the amount of these XXXX withdrawals exceeds the dollar limit on single day transfers that Citi itself imposes on its account holders. Since XX/XX/XXXX, I have invested considerable time and effort trying to recover my purloined funds. I have spoken to numerous Citi representatives in numerous Citi departments, including but not limited to the Wire Department, the Incidence Report Unit, the XXXX XXXX XXXX XXXX, the Citi XXXX XXXX XXXX, the XXXX Department, and a unit simply described to me as XXXX XXXX Department. I have the names of Citi representatives I have spoken to and the times of my calls. In addition, on XX/XX/XXXX, I wrote directly to XXXX XXXX, XXXX XXXX, and its Chief Legal XXXX, XXXX XXXX, requesting that my funds be returned to me.. As mentioned above, on XX/XX/XXXX, Citi notified me that it was denying my claim for reimbursement, alleging that I did not take adequate steps to safeguard my account. Citi provided no information to explain or support this allegation. Contrary to XXXX allegation, I have always taken reasonable steps to safeguard my account, including but not limited to the following : : I employed a XXXX character user name and password composed of a mix of both random numbers and letters. I never used my Citi user name and password on other sites. At no time did Citi ever advise me that my user name or password was weak or inadequate. I never used my user name or password on a public Wi-Fi. I had established a security question with Citi, to be used to safeguard my account. I never shared this security question with anyone. I did not have nor did I use a Citi mobile app. To the best of my knowledge, I NEVER used my Citi debit card.. Indeed, I never even took the card outside of my home. The card was always inside my home under my control and custody. I carefully reviewed and checked each Citi monthly statement. In addition, I very frequently monitored my account on-line. I did not use social media sites like XXXX or similar platforms. I used XXXX software on my computer to protect against computer viruses and malware and to run system scans.. According to AI overview, XXXX is consistently rated as a top-tier XXXX, often outperforming competitors like XXXX, XXXX and XXXX Defender with near-perfect malware detection rates and frequently earning perfect scores in tests by industry-standard labs like AV-Test. I scrupulously avoided suspicious links on my email and text messages. These steps conform with what a reasonably prudent person would do and constitute adequate steps to protect my account security. And my efforts to safeguard my account did not stop there. I reference again that after the first hint of an unauthorized withdrawal from my account and likely BEFORE the second unauthorized withdrawal I IMMEDIATELY contacted Citi to check into the situation and was told by Citi that there was no cause for concern. And literally only minutes after XXXX email to me referencing the second unauthorized withdrawal, I once again contacted Citi and told it that I had not authorized any withdrawals. Yet despite my prompt alerts and my erstwhile efforts to protect my account, Citi allowed the second withdrawal to go through as well. The cause of the improper transfer of my funds was not that I did not take adequate steps to safeguard my account, but that Citi failed to do so. In support of this statement, let me cite the following admissions and assertions by Citi. In a call to Citi on XX/XX/XXXX at around XXXX pm, the Citi rep I spoke to admitted that the withdrawals had not been initiated or authorized by me. Yet, Citi permitted them. In a call to Citi on XX/XX/XXXX, at around XXXX, a Citi rep told me that Citi always asks for confirmation before executing wire transfers and seeks prior authorization from the account holder. Yet, this was not done in my case. And in a call with XXXX XXXX XXXX XXXX on XX/XX/XXXX, XXXX XXXX admitted that the withdrawals should have been flagged, adding that it was very strange and very weird that they were not. Let me further note that in a number of my calls with Citi, I was required to answer my established security question before Citi would discuss matters with me. I have never shared my security question with anyone.. So I am compelled to question whether Citi followed the same procedure before allowing the XXXX unauthorized withdrawals from my account It is instructive to put these matters into the context of security features claimed by Citi at its on-line site titled Citi Protects You. Security. In pertinent part, that site states : Citi will flag suspicious activity on your consumer debit or credit card and may contact you by phone, text, email or mail to confirm whether you authorized the purchases. Whether youre banking with us on Citi Online or using the Citi Mobile App, you can be assured that our advanced security features are keeping your account information protected XXXX. XXXX inept and incompetent safeguarding of my funds stands in stark contrast with its boastful online security claims. Citis allegation that I did not take adequate steps to protect my account is merely an attempt by Citi to deflect from its own security lapses and porous security system. That a bank with the considerable resources, expertise and experience that Citi has could allow the XXXX unauthorized withdrawals on the same day and just a few hours apart is simply gross negligence. In short, Citi is responsible for facilitating the misappropriation of over {$38000.00} of my money. Under legal theories of negligence and under either Article XXXX of the XXXX or Regulation XXXX of the XXXX, Citi should be required to return these XXXX funds to me, plus any associated fees and lost interest.

Company public response: Company has responded to the consumer and the CFPB and chooses not to provide a public response
Company response to consumer: Closed with explanation