NYS AG Letitia James Seeks to Hold Citibank Accountable for Failing to Protect Banking Customers

NYS Attorney General Letitia James

Attorney General James announced on Jan. 30, 2024 that her office, the Office of the Attorney General (OAG), is seeking to hold Citibank (Citi) accountable for failing to protect its customers.  James said she is also looking to require the company to pay back defrauded New Yorkers with interest, pay penalties, and adopt enhanced anti-fraud defenses to prevent scammers from stealing consumers’ funds.

OAG has found that the bank fails to respond to fraudulent activity appropriately and quickly, according to James, who further noted that as a result of Citi’s lax security, New York customers have lost millions of dollars, and in some instances, their entire life-savings, to scammers and hackers. 

“Banks are supposed to be the safest place to keep money, yet Citi’s negligence has allowed scammers to steal millions of dollars from hardworking people,” James said.  “Many New Yorkers rely on online banking to pay bills or save for big milestones, and if a bank cannot secure its customers’ accounts, they are failing in their most basic duty. There is no excuse for Citi’s failure to protect and prevent millions of dollars from being stolen from customers’ accounts and my office will not write off illegal behavior from big banks.”

For all of these reasons, James and OAG sued Citi on Jan. 30, 2024 for failing to protect and refusing to reimburse victims of fraud. 

According to James, the lawsuit alleges that Citi does not implement strong online protections to stop unauthorized account takeovers, misleads account holders about their rights after their accounts are hacked and funds are stolen, and illegally denies reimbursement to victims of fraud.

OAG provided the following series of situations that form the basis for OAG’s claims against Citi:

1. One New Yorker had $40,000 stolen from her retirement savings account. In October 2021, the customer received a text message that appeared to be from Citi instructing her to log onto a website or call her local branch. The customer clicked the link in the message but did not provide additional information as requested in the text message. Afterwards, the customer called her local branch to report the suspicious activity but was told not to worry about it. Three days later, the customer discovered that a scammer changed her banking password, enrolled in online wire transfers, transferred $70,000 from her savings to her checking account, and then electronically executed a $40,000 wire transfer, none of which was consistent with her past account activity. For weeks, the customer continued to contact the bank and submit affidavits, but in the end, she was told that her claim for fraud was denied

2. Another New Yorker had $35,000 stolen from her account. She was reviewing her online account and found a message that her account had been suspended and was instructed to call a phone number. She called the number provided and a scammer told her that he would send her Citi codes to verify recent suspicious activity. The scammer then transferred all of the money in the customer’s three savings accounts into her checking account, changed her online passwords, and attempted a $35,000 wire transfer. Citi attempted to verify the wire transfer by calling the customer, but she was working and did not see the call at the time. Less than an hour later, the scammer attempted another $35,000 wire transfer, which Citi approved without ever having made direct contact with the customer. She lost nearly everything she had saved, and Citi refused to reimburse her. 

James and OAG say Citi fails to appropriately respond to notifications of fraud by its customers. When victims contact the bank to report fraud, Citi leaves them on lengthy telephone holds, allowing scammers to continue their fraud. Additionally, Citi does not implement sufficient measures to protect consumers from future unauthorized transactions until they visit a local branch. Citi representatives falsely told consumers that their accounts were secure and often promised that their money would be returned, although the bank did not take immediate steps to recover stolen funds. Citi also falsely tells consumers that they need to visit local branches and execute special affidavits detailing the scams that led to their losses — information Citi then used to blame consumers and deny their claims. 

Through this lawsuit, Attorney General James is seeking to stop Citi’s deceptive practices and to collect restitution for victims who were denied reimbursement in the last six years, penalties, and disgorgement.