Trust

Identity Theft - probably one of the words we take for granted but dreaded the most when it finally happen to ourselves.

To me, it manifested one fateful morning when I woke up to a text message from Citibank that my card was blocked because someone used my credit card a few hours prior. The damage amounted to 2 successful transactions of $3175 each.

For a split-second, a smorgasbord of emotions swept over me. There was much confusion - with my half-sleep mind trying to process the stimulus at hand. There was self-doubt - retracing all my activities a few days leading to this day where I could have possibly exposed my financial credentials. There was genuine fear - the uncertainty on what was the extent of the breach. The fear for the worst - that I will be forced to pay the 6350 in US Dollars (roughly 300,000 in Philippine pesos). And that's not including the legal fees when I choose to fight against the behemoth - that is Citi. And lastly there's rage. Angry at the people who exploit the vulnerabilities of the system - the world even - to get ahead, to profit at the expense of other people. Angry at Citibank for downplaying the threat. Several times, Citibank never failed to email or text me if there are unusual purchases being made. This particular purchase raised all red flags and yet Citibank allowed 2 transactions to push through - without email, one-time pin, or text confirmations.

Someone somewhere is expecting an all-star concert

I called the Citibank hotline to make sense of the whole situation. The agent assured me that I have nothing to worry about. Not surprisingly, it had the exact opposite effect on me. I became paranoid the whole day. I could not file a dispute unless the merchant submits the transaction and Citibank decided to post it as valid.

I called Citibank again to ask my lingering question on why, for fuck's sake, I haven't been asked for confirmation or one-time pin when the transactions were made. The answer I got from the agent I talked to bordered on stupid. In essence, she said that there are times when there are no One-time pin and that this is actually advantageous for me, the client, since the OTP adds an "unnecessary" delay in submitting a transaction. The OTP, if you didn't know, adds a layer of security by requiring a PIN sent to your mobile at the time of transaction. The agent basically said that they allow a ticket purchase at 2 in the morning using a shady online ticketing system based in another country without requiring a proof of my identity just because I might be scouring the interwebs for cheap tickets. Yeah, that makes sense.

And just like that. As much as I like Citibank card perks, they are holding back on security to please the average clients.

At first I thought these were airline tickets. I wondered why would someone buy tickets through fraudulent means when there are risks of being caught at the airport? It never took a while for me to realize that someone somewhere was being scammed using a legit ticket purchased using my card. After a few googling, My Ticket Tracker sells events tickets and there were already complaints of scams here, here, here and everywhere.

And here I am, hoping that Citibank has more stringent measures in dealing with shady websites to flag possible fraudulent transactions.  To say that I am very much disappointed is pretty much an understatement.

To be fair, I believe Citibank will never post the transaction under my name whenever the merchant decided to submit whatever documents they submit. Nevertheless, this doesn't change the fact that a fraudulent transaction pushed through and a possible scam took place in some other place to an unsuspecting victim.

And that friends, how I lost my trust to Citibank. I'd still probably use my card with them when all the dust has settled. But trust, as the saying goes, is like a broken vase. It may be fix eventually but it'd never be the same.