Consumer fraud is at an all-time high, with an estimated one in five people losing an average of $1,000 in online scams and bank fraud in 2022. Despite elderly victims being the most commonly targeted, it’s estimated that 286,890 adults ages 30-39 were victims of some form of money fraud in 2022.

While banks and financial institutions are supposed to have some of the most secure defenses against fraud, some customers are saying that their banks are not doing enough. Customers have even gone as far as accusing the banks of making it easier for fraudsters to perpetrate their schemes.

Those claims and others are at the heart of a new lawsuit filed by New York Attorney General Letitia James against leading financial institution Citibank.

In a press release issued by James' office this week, James argues that “Citi does not implement strong online protections to stop unauthorized account takeovers, misleads account holders about their rights after their accounts are hacked and funds are stolen, and illegally denies reimbursement to victims of fraud."

As a result of Citibank's poor security measures, the AG's office argues that customers "have lost their life savings, their children's college funds, or even money needed to support their day-to-day lives as a result of Citi's illegal and deceptive acts and practices."

In addition to its poor security defenses, the AG’s office says that Citi did not effectively respond to red flags and did not flag or stop suspicious activity, including large and unusual money transfers between and out of user accounts.

Over the past couple of months, several cases have been reported, highlighting just how easy it has been for scammers to defraud customers out of their funds. The press release highlights the July 2022 case of a New York woman who lost $35,000 in an elaborate but highly effective scheme.

NY resident Denise Apostle, the daughter of a retired NYPD officer who investigated fraud, shared that she always knew what to look for when it came to her online safety. However, the sophistication of the scam made it incredibly easy for fraudsters to conduct what is known as an “account takeover.”

Apostle used her Citibank account to pay bills online. During one of her transactions, she received notification that her account had been compromised. The notification included directions of what to do and and number to call. The number was advertised as being Citibank.

After calling the number, Apostle says the fraudster “had the same lingo when I usually speak to someone from Citibank.” The scammers also provided Citi codes that were sent directly to Apostle’s phone. She says the codes she received look almost identical to the codes Citi would normally send.

The scammers then alerted Apostle on how to change her password. Once her account password changed, the scammers transferred money out of her savings, into her checking, and attempted to wire $35,000 out of her account.

The next day, Citibank’s fraud department attempted to contact Apostle to verify the wire transfer, but the bank left a voicemail because Apostle was working at the time of the call.

The scammers attempted to wire the money out a second time and were successful after Citi approved the transfer, despite never making contact with Apostle to notify her about the suspicious behavior.

The AG’s statement also shared details of a different case that employed similar fraud tactics. In October 2021, a Citi customer received a text alert with a link advising her to change her password because of suspicious activity.

The woman did not click the link but contacted her local branch to report what she described as suspicious activity. Despite her concern, the AG’s office says she “was told not to worry about it."

Three days later, the woman discovered that her banking password had been changed by the scammers and that $70,000 was transferred from her savings account to her checking account. A wire of $40,000 was then made out of her checking account.

Despite this activity being unusual behavior for her accounts, “the customer continued to contact the bank and submit affidavits, but in the end, she was told that her claim for fraud was denied,” the AG’s office says.

James's lawsuit argues that under the Electronic Fund Transfer Act (EFTA), Citibank and other financial institutions must reimburse customers who fall victim to fraud. "As with credit cards, so long as consumers promptly alert banks to unauthorized activity, the EFTA limits losses and requires reimbursement of stolen funds. These consumer protections cannot be waived or modified by contract... Under the EFTA, Citi's electronic debits of consumers' accounts are unauthorized and Citi must reimburse all debited amounts," the lawsuit reads.

Citibank has pushed back against the lawsuit and the claims that it should be held responsible for the fraud. Citi expressed in a statement that it “closely follows all laws and regulations related to wire transfers and works extremely hard to prevent threats from affecting our clients and to assist them in recovering losses when possible. Banks are not required to make clients whole when those clients follow criminals' instructions and banks can see no indication the clients are being deceived.”

Citibank has acknowledged the rise in online bank theft but says that it has "taken proactive steps to safeguard our clients' accounts with leading security protocols, intuitive fraud prevention tools, clear insights about the latest scams, and driving client awareness and education.” The company adds, “Our actions have reduced client wire fraud losses significantly, and we remain committed to investing in fraud prevention measures to help our clients secure their accounts against emerging threats."

James’ lawsuit argues otherwise and is seeking an injunction against Citibank plus documentation and accounting of losses that customers have sustained over the last six years, as well as restitution and damages for victims and civil penalties.