Attorney General Letitia James alleged that the U.S. banking subsidiary of Citigroup does not implement strong data security and anti-breach practices, fails to respond appropriately to customers' claims of wire-transfer fraud and does not quickly and adequately inform them about their rights after their accounts are hacked and funds are stolen. James is also accusing the bank of illegally denying reimbursement to victims.

The lawsuit — James' latest action against a big bank — is calling for Citi to pay penalties, improve its anti-fraud defense systems and pay back, with interest, New York-based customers who were victims of fraud in the past six years and denied reimbursement.

"Banks are supposed to be the safest place to keep money, yet Citi's negligence has allowed scammers to steal millions of dollars from hardworking people," James said in a press release. "If a bank cannot secure its customers' accounts, they are failing in their most basic duty."

In response to the accusations, a Citi spokesperson said in an email that the company "closely follows all laws and regulations related to wire transfers and works extremely hard to prevent threats and to assist [clients] in recovering losses when possible." Yet banks don't have to fully reimburse customers for such fraud when customers follow scammers' instructions and "banks see no indication the customers are being deceived," the spokesperson said.

The Citi spokesperson added that the bank has "taken proactive steps to safeguard clients' accounts," given the industry-wide increase in wire-transfer fraud in recent years. Those steps include the addition of new security protocols and fraud prevention tools and more customer education.

"Our actions have reduced client wire fraud losses significantly, and we remain committed to investing in fraud prevention measures to help our clients secure their accounts against emerging threats," the Citi spokesperson said in the email.

Among the allegations in the New York AG's lawsuit is a claim that Citi, once it has been notified by customers of stolen funds, locks customers' bank accounts and tells them to visit their local Citi branch. The result is "investigations that are delayed hours or days," which permits scammers to "escape with stolen funds held at beneficiary banks," according to the lawsuit.

The suit also states that customers "have lost their life savings" as a result of the fraud, with criminals diverting "millions of dollars from New York consumers as a direct result of Citi's illegal and deceptive acts and practices."

In one example, a Citi customer lost $40,000 when she clicked on a link in a text message that appeared to be from Citi. According to the lawsuit, she did not provide further information as requested in the message, but when she notified Citi of the event, she was told to not worry about it.

The customer repeatedly contacted the bank and submitted affidavits, but Citi said her fraud claim was denied, according to the lawsuit.

The AG's lawsuit is the latest challenge for Citi, which is going through a major overhaul under CEO Jane Fraser. The $2.4 trillion-asset company is trimming its operations, simplifying its management structure and reducing its costs in an attempt to improve its long-lagging profitability and returns.

Citi is also engaged in a multiyear revamp of its risk management and internal compliance systems. The so-called "transformation" effort is largely a response to two regulatory consent orders issued in 2020. Those enforcement actions followed years of concerns that Citi had let too many errors occur, including a mistaken payment of $900 million to creditors of the cosmetics company Revlon.