Citibank Fraud Lawsuit: New York's Scam-Reimbursement Case

The Allegations

In January 2024, the New York State Attorney General sued Citibank, alleging the bank did too little to protect customers from online fraud and then wrongly refused to make victims whole. According to the complaint, scammers were able to take over customers’ accounts — for example through phishing — and drain them via wire transfers, while Citi allegedly lacked strong enough security to stop the takeovers and then denied reimbursement, sometimes arguing the transfers were ‘authorized.’ The suit contends this violated the federal Electronic Fund Transfer Act (EFTA) and state law, and it seeks to force Citi to repay defrauded New Yorkers with interest and improve its defenses.

The case tests an important question: how much responsibility a bank bears when criminals exploit weak security to steal a customer’s money.

The Case Proceeds

Citi asked the court to dismiss the lawsuit, but in early 2025 a judge denied that request on the core claims, allowing the case to move forward — and notably finding that the EFTA’s protections can apply to unauthorized wire transfers from consumer accounts. That ruling matters beyond Citi, because it strengthens the argument that banks must reimburse certain fraud losses. The litigation was ongoing at the time of writing, with no settlement or final judgment.

A win for the state could push banks industry-wide to reimburse more scam victims and tighten account security.

What Customers Should Know

If a criminal made unauthorized transfers from your account (for example after hacking in), federal law generally requires the bank to investigate and reimburse — report it immediately and in writing, and escalate or file a regulator complaint if the bank refuses. Protect yourself by enabling strong authentication, never sharing one-time codes, and treating any urgent request to move money as a red flag, since scams that trick you into authorizing a transfer yourself are harder to recover.