Citi sued by NYS attorney general, accused of failing to protect customers from ID theft

State Attorney General Letitia James on Tuesday filed a federal lawsuit against Citigroup, N.A., alleging that the global banking giant cost its New York customers “millions of dollars” by failing to adequately protect them from ID theft and illegally refusing to reimburse them.

The 71-page complaint in the U.S. District Court for the Southern District of New York accused Citi of providing an inadequately weak level of defense against scammers, ineffectively responding when notified of ID thefts, misleading customers who believed someone had stolen their money, and denying their claims for compensation.

“Many New Yorkers rely on online banking to pay bills or save for big milestones, and if a bank cannot secure its customers’ accounts, they are failing in their most basic duty,” James said in a statement. “There is no excuse for Citi’s failure to protect and prevent millions of dollars from being stolen from customers’ accounts.”

The attorney general did not provide a specific estimate about how many Citi customers were impacted by its reimbursement policies, or how much was lost.  

Citi, headquartered in New York, asserted that it closely follows all laws and regulations, and that it strives to secure customer information.

“Banks are not required to make clients whole when those clients follow criminals’ instructions and banks can see no indication the clients are being deceived,” Citi spokesperson Colin Wright said in a statement.

The bank has about 200 million customer accounts worldwide and earned a profit of $9.2 billion last year. Its stock rose 5.51% Tuesday.

The dispute likely will hinge on the court’s interpretation of federal laws and regulations related to wire transfers, and how they apply to financial institutions like Citi.

James asserts that Citi is subject to a federal consumer protection law known as the Electronic Fund Transfer Act of 1978, which limits customer losses if they promptly alert banks of unauthorized charges. Meanwhile, according to the lawsuit, Citi is instead following a different set of state laws known as the Uniform Commercial Code, which does not require banks to reimburse transfers. 

ID theft is a growing concern in the United States as scammers become increasingly adept at weaving through security systems and tapping the personal accounts they are supposed to protect. Cases of bank fraud, credit card fraud and other ID theft nearly doubled in the U.S. from 2019 to 2023, according to data compiled by the Federal Trade Commission. In New York, the FTC reported 39,500 cases of ID theft in the first three quarters of 2023, up 53% from the same period in 2019.

Retirement funds stolen

Scammers employ a variety of tactics to attack their targets' accounts. James’ lawsuit mentions an incident in which $40,000 vanished from a Citi retirement account in October 2021. The customer had received a text message that appeared to come from Citi that instructed her to contact her local branch. The woman clicked on a web link in the text, and when it didn’t provide her the right information, she reported the incident to her local branch. A few days later, the woman discovered that someone had changed her account password and transferred the money out of her account.

The lawsuit alleges that the customer tried for weeks to retrieve her money, only to be rebuffed by Citi.

The attorney general’s office criticized Citi’s security systems for ineffectively responding to “red flags” — actions that should trigger an anti-fraud response, such as people accessing accounts from unrecognized devices. Citi is accused of neglecting to flag or stop transfers from multiple accounts into a single account and failing to automatically initiate investigations or report fraudulent activity to police when reported by its customers.

James is asking the court to order Citi to hire an independent auditor to look into its customers’ claims of ID theft and, where appropriate, to reimburse them for their losses.

Do you think you've lost money to online hackers? If so, the New York Attorney General is asking that you report your experiences to the OAG's Consumer Frauds Bureau or call 800-771-7755.