Credit card compromised, Citibank tells me to "call back later"

[Mattg]

I just noticed that quite a large transaction had been made on my Coles Mastercard (which is issued by Citibank), so I called up immediately to report this. The lady informed me that their systems are currently being updated so I would have to call back in 3 hours. She didn't want to take my details or anything. Meanwhile, my card (which I can only assume has been compromised) is still active until then.

Is this normal?

 

[Jacques Vert]

Not normal IME. Is it possible to action this online?

 

[jinks485]

Totally not normal - but also totally not surprising from Citibank. Honestly their customer service is the worst!
Do you know if there will be a record that you called? That will help with the claim if more transactions pop up this morning.

 

[blacksultan]

The call should be recorded . Call again and ask for call to be recorded

 

[glasszon]

I think it varies by state, but if your state allows it then I would make a recording yourself as well about how their system is down and hence cannot stop the card, if they can't even do this basic function then it won't surprise me if they tell FOS that they "lost" the recording of the call.

 

[cove]

Mrscove had some hotel accommodation in Italy booked on one of her Citi cards. It took several months with a replacement card and finally a credit as the hotels were back charged seeing we were not doing anything in Italy.

 

[theblank]

Meanwhile, my card (which I can only assume has been compromised) is still active until then.

Is this normal?

Doesnt matter - this is Citibanks loss not yours. The reason for Citibank to stop the card is to protect Citibank.
The only potential loss to yourself is the time and money it will take you to call Citibank back a 2nd time

 

[Brissy1]

call recording doesn't have to be a one-way thing, recorded it on your phone, there are many apps available. Of course you would have to let them know that you were doing so to comply with Australian law..."for customer (you) service" reasons.

 

[Hvr]

So, were there any expenses between when you originally called and when you called back later?

 

[RooFlyer]

Doesnt matter - this is Citibanks loss not yours. The reason for Citibank to stop the card is to protect Citibank.
The only potential loss to yourself is the time and money it will take you to call Citibank back a 2nd time

Its Citibank's risk only if the cardholder reported the first mis-transaction. If Citibank failed to note the first report due to 'systems down', and more mis-transactions then occur, they could try to put it onto the cardholder, until cardholder can prove otherwise. If no recording of the first call, then I guess OP can show a call made from their own phone records, but it will get time consuming and messy.

 

[Mattg]

So, were there any expenses between when you originally called and when you called back later?

I called back later that day and they were able to block the card etc.

I don't believe any more transactions had been made in the meantime (luckily) but I can't actually access any of the card details in my online account any more, so can't be 100% sure until they complete their investigation and call me back. Either way, the liability is on Citibank.

I just thought it was so bizarre that they wouldn't take something like this more seriously!

 

[Pushka]

I called back later that day and they were able to block the card etc.

I don't believe any more transactions had been made in the meantime (luckily) but I can't actually access any of the card details in my online account any more, so can't be 100% sure until they complete their investigation and call me back. Either way, the liability is on Citibank.

I just thought it was so bizarre that they wouldn't take something like this more seriously!

We had similar issues with a NAB card that was being used for an online betting Agency membership in the UK. NAB simply told us we should cancel the online betting account, probably their CYA response so we couldnt retrieve the money (something like Pounds 300 each month.) Obviously we couldnt cancel as we never had an account in the first place. Finally we just walked into the main branch and told them to cancel the card and handed it over. They said that would be at our inconvenience as this would cancel ongoing direct debits - but there werent any for us to worry about. They seemed so reluctant to do this! We suggested a call to the Ombudsman might be in order as we had kept a log of our calls etc. The card was cancelled forthwith and monies returned.

Then randomly they cancelled another one of our business accounts simply because two taxi charges (both legitimate) occurred in Melbourne on the same day - their reponse was that we thought it was fraud as we are based in Adelaide (banging my head on the wall dealing with NAB). I suggested they had just left one of our people stranded interstate with no credit card and to sort it - NOW!

 

[Danger]

I think it varies by state, but if your state allows it then I would make a recording yourself as well about how their system is down and hence cannot stop the card, if they can't even do this basic function then it won't surprise me if they tell FOS that they "lost" the recording of the call.

In New South Wales, the Surveillance Device Act (2007) permits 'covert' recording in certain circumstances. Refer to Part II, s. 7(3).

call recording doesn't have to be a one-way thing, recorded it on your phone, there are many apps available. Of course you would have to let them know that you were doing so to comply with Australian law..."for customer (you) service" reasons.

Under NSW law, no, you don't need to inform the other party. That said, 95% of the big companies I call always tell you 'Your call may be recorded for quality and training purposes'. Ergo, the other end already knows the call might be recorded; why tell them a second time?

 

[MEL_Traveller]

Do we really think a credit card company is going to deny responsibility over a technicality of someone recording a call? That would be somewhat unfair

 

[Spongbob]

I think the Banking and Financial Services Royal Commission findings show "unfairness" is not a concept these firms appreciate.

 

[theblank]

Its Citibank's risk only if the cardholder reported the first mis-transaction0

not true at all, there could be many transactions not reported for a period of a few weeks and its still Citibanks loss.
there is a specific time frame in the regulations that it should be reported, and its quite a long time, and its not days, nor weeks.

If Citibank failed to note the first report due to 'systems down', and more mis-transactions then occur, they could try to put it onto the cardholder, until cardholder can prove otherwise. If no recording of the first call, then I guess OP can show a call made from their own phone records, but it will get time consuming and messy.

if citibank have no record of the call, then they have no record of the call. they have nothing to put onto the cardholder.

 

[RooFlyer]

not true at all, there could be many transactions not reported for a period of a few weeks and its still Citibanks loss.

I was relying on the ePayments code for my comment, which in part says ...

When you may not get your money back after an unauthorised transaction
There is less chance of getting your money back from an unauthorised transaction if you:
* unreasonably delayed telling your financial institution that your card was lost or stolen or that someone else may know your PIN or password

Now that's not exactly the same as what the OP said, but I've always thought the onus was on the cardholder to report possible misuse as soon as it was suspected, else they will/may bear the liability.

I'm happy to be corrected .... can you really let a card be misused for weeks and still not be liable for the charges?

 

[brucebrad]

One other problem with Citibank: If you have a direct debit payment setup, and the fraudulent payments happen towards the end of your payment period, then you might end up having to pay the whole amount (and then have your card go into credit when they get refunded). The only way to stop this is to cancel the direct debit (and reinstate it later) which is a pain to organise. This will happen even if the payments have been refunded by the direct debit date (the direct debit will be based on the statement balance, not the current balance).

 

[SOPOOR]

Last year i got a call from nab bank from automated msg, and it said dear mr so and so, we have your date of birth as 1st jan, please enter on the keypad your year of birth to be put through

Naturally this is as sus as you can get

Called nab line to report it, they said nothing we can do

Called local branch manager and told them that this could be a huge security breach, he gave me a fake reference number which was his first name123

Said id get a call back within 48 hours,

Didnt hear back for a week,

Had to go to ombudsman for another matter, in their reply they said "yeah it was a genuine call"

Nothing surprises me with these banks these days

 

[MEL_Traveller]

I was relying on the ePayments code for my comment, which in part says ...

When you may not get your money back after an unauthorised transaction
There is less chance of getting your money back from an unauthorised transaction if you:
* unreasonably delayed telling your financial institution that your card was lost or stolen or that someone else may know your PIN or password

Now that's not exactly the same as what the OP said, but I've always thought the onus was on the cardholder to report possible misuse as soon as it was suspected, else they will/may bear the liability.

I'm happy to be corrected .... can you really let a card be misused for weeks and still not be liable for the charges?

Sure - it could be several days, even weeks for some if they don't do online banking.

You are right - the cardholder has to report the misuse as soon as practicably possible after it is suspected.