New York State Attorney General Letitia James is suing Citibank, saying it failed to protect customers from hackers and scams and refused to compensate victims after allowing fraudsters to steal millions of dollars from their accounts. The financial institution also unlawfully refused to reimburse fraud victims in violation of the Electronic Funds Transfer Act (EFTA), the complaint alleges.
Because Citibank offers online banking and mobile banking wire transfer services, it should also provide compensation to fraud victims, just like the protections afforded to victims of electronic credit or debit card fraud under the same law.
The European Free Trade Area requires banks to reimburse customers for any funds lost or stolen due to unauthorized electronic transactions. However, New York State Attorney General James said that Citibank took advantage of a special exception in these regulations, resulting in the denial of compensation applications filed by consumers after they were hacked or became victims of fraud, causing huge economic losses to New York consumers, amounting to millions of dollars.
Attorney General James said: "Banks should be the safest place to keep your money, yet Citibank's negligence allowed scammers to steal millions of dollars from hardworking people. Many New Yorkers rely on online banking to pay bills or save for important events, and if a bank cannot ensure the security of customer accounts, then they are failing in their most basic responsibility. There is no excuse for Citibank's failure to protect and prevent the theft of millions of dollars from customer accounts, and my office will not turn a blind eye to the illegal conduct of big banks."
New York's attorney general has launched an investigation into how Citibank protects customers from scammers and hackers, finding the bank fell short in responding to signals of potential fraudulent activity. Notably, the bank's systems did not respond effectively to attackers using unidentified devices, accessing accounts from new locations, or even changing a user's banking credentials.
Additionally, Citibank failed to flag and block attempts to transfer funds from multiple accounts to a single account, making it easy for malicious actors to quickly transfer tens of thousands of dollars from a victim's Citibank account in just minutes.
The complaint also highlights Citibank's alleged failure to automatically initiate investigations or report fraudulent activity to law enforcement after customers submitted initial reports to the bank.
Victims who complained to Citibank also faced long wait times on the phone, allowing scammers to continue transferring stolen funds to bank accounts they controlled at third-party banks.
Citibank representatives also allegedly falsely assured customers whose accounts had been hacked or taken over by scammers that their funds were safe and promised to return stolen funds without taking immediate action.
In addition, they falsely directed consumers to local Citibank branches to sign special affidavits detailing the scams they had experienced, then used that information to blame the victims and deny their claims for reimbursement with template letters outlining predetermined conclusions, such as failing to adequately protect their accounts or handing over account information to scammers.
"Through this lawsuit, Attorney General James is seeking to stop Citibank's deceptive practices and collect restitution, fines and penalties from victims who were denied reimbursement over the past six years," Attorney General James said.
Two years ago, James also led a coalition of state attorneys general urging major banks including JPMorgan Chase, Bank of America, U.S. Bank and Wells Fargo to eliminate overdraft fees on consumer accounts.