New York Attorney General Letitia James is suing Citibank for allegedly failing to protect account holders from online fraud and failing to reimburse customers in the state for millions of dollars in losses. 

Citi does not maintain strong protections to stop unauthorized account takeovers, misleads customers about their rights after their accounts are hacked and money stolen, and illegally denies reimbursements to those defrauded, according to the lawsuit filed on Tuesday. 

Citi customers have lost their life savings, their kids' college funds and money to get by, as a result of the bank's practices, the state contends. 

One New Yorker lost $40,000 after receiving a text message telling her to log onto a website or to call her local branch. The woman clicked the link but did not provide the requested information, and reported the suspicious activity to her local branch, which told her not to worry. Three days later the customer found a scammer had changed her password, enrolled in online wire transfers and then electronically executed a wire transfer. The customer's fraud claim was denied by Citi. 

The AG's office found that Citi's systems do not respond effectively to red flags such as scammers using unrecognized devices or accessing accounts from new locations. Further, its processes do nothing to halt the transfer of funds from multiple accounts into one, and then send tens of thousands of dollars within minutes. 

The bank also does not automatically start investigations or report fraudulent activity to law enforcement when customers first report it to Citi, the third largest banking institution in the U.S., the state contended.

"Many New Yorkers rely on online banking to pay bills or save for big milestones, and if a bank cannot secure its customers' accounts, they are failing in their most basic duty," New York Attorney General Letitia James stated. 

Citi follows laws and regulations related to wire transfers and works to prevent threats to its customers, and assists them in recovering losses when possible, the bank said in response. 

"Banks are not required to make customers whole when those customers follow criminals' instructions and banks can see no indication the customers are being deceived," Citi stated. "However, given the industrywide surge in wire fraud during the last several years, we've taken proactive steps to safeguard our clients' accounts," stated the bank.

Kate Gibson

Kate Gibson is a reporter for CBS MoneyWatch in New York.