We were recently the victims of check fraud with Citizens Bank. The way this fraud took place and the manner in which the bank responded are the reason for this post. This is a warning to all Citizens Bank customers.
Here is what happened.
In one case, my wife wrote a check, which was handed to the payee who deposited the check at their bank and it properly cleared. Six days later, a check in the same amount was paid by our bank not once, but twice on the same day. Here’s what Citizens Bank failed to flag:
- Two checks, one number apart, for the same exact amount deposited on the same day.
- These two checks were obvious photocopies.
- These two checks where hand written except for the payee, which was typed in.
- Below the written out amount line, a payee address was typed in.
- The day and month on the date line are written in different handwriting.
- The check number was typed in and not pre-printed. It was also out of position.
- The security border and other check features are missing.
All of this was missed by the banks mobile deposit and verification systems.
In a second case, on a different account, an electronic check was entered online and sent to the payee. This check was received and deposited by the intended recipient and paid properly. Three months later, within the same time window as the first event, checks in the exact same amount were deposited and paid by Citizens Bank, three times on one day, one time the next day and two more times the day after that. That is six identical transactions over three days that were not flagged by Citizens fraud department. Here is what Citizens Bank failed to flag in this instance:
- Once again, the fake checks were photo copies.
- The six check numbers were within a range of thirteen numbers.
- The font of the check date, payee and address were different from the rest of the check.
- Security features of the check were missing from the duplicates.
This was all missed by Citizens Bank mobile deposit and check verification systems.
One account also had two ach withdrawals to pay a credit card one day apart with no transaction number recorded.
I noticed the check fraud one evening while doing normal maintenance on our accounts. I immediately went to a local branch that is open late. I was informed that this is happening “all the time” and that it’s a “huge issue” for the bank. The local staff was very helpful and supportive and walked us through the required paperwork to file claims for the fraud and the freeze our accounts and get new ones opened. The paperwork was cumbersome and required a few trips back to the branch to complete. We were told that becuase this was obviously not our fault, the bank would return the funds lost. We were told the bank has 10 business days, by law, to research the matter and let us know when we will get our funds back. We are at 14 business days and counting with no contact from the bank.
To add insult to injury, it was our responsibility to call the banks online department to have our online profiles deleted and to setup new ones so we could access the new accounts and see our history, which is now frozen from the impacted accounts. We did that, but only were given one online ID for me. My wife had to call and get her own online access set back up. Imagine our absolute disgust, when she called to do so and found out that Citizens had “randomly” set her up with a new online account the day after we froze our accounts and that her new usersname was her Social Security Number, plus one letter. Yes, you read that right. Citizens Bank setup a customer with an online usersname that was their Social Security Number! Unbelievable! Grossly negligent. We never authorized nor requested this to be done and yet it was. Worse, the “temporary” password was “welcome1.” Hardly anything secure.
Needless to say, we no longer trust that Citizens Bank is a safe place for our money or our family members. If you or anyone you know is a customer of Citizens Bank, watch your accounts closely and be certain that your online passwords are highly secure.
Speaking of passwords, Citizens Bank does not allow truly complex passwords. They do not allow any symbols, only upper and lower case characters and numbers. The vast majority of my small business clients have more secure password policies. For a financial institution, they should be ashamed.
I will be reporting our experience to the State Banking Commission as something is very wrong with the control within the bank and the public needs to know and be protected. I can’t imagine we are the only victims and can only hope that others have not had the run around we have. Citizens used to be a great bank. We’ve been customers for decades, but these security lapses are inexcusable.