I am so sorry this happened to you. I’m convinced this is an inside job where one or more of Citis employees are selling account numbers to hackers.

I had almost the exact same thing happen in 2019. Two ach bill payments, one from my checking for a few hundred dollars and one from my savings for a couple thousand.

I joined Citibank for a $500 bank bonus and I follow blogs/subreddits about chasing these bonuses. I’m apparently not the only one this has happened to from reading the comments so I’m pretty sure it’s a systematic issue.

Unfortunately, I do not have any advice since it seems like you exhausted all the obvious avenues. Keep detailed records of the dates/times you talked to reps and what was said. I think it’s really now your decision if it’s worth pursuing legal action.

For me, I was able to catch it immediately and did a stop payment on the savings and froze that account (I believe the term was “post no debits”). Due to Citi’s incompetence, they did not process the stop payment on the checking account and could not freeze the account (some bs reason because I never signed a signature check card) so there were a few more attempts to drain more money. After the second drain, I filed a CFPB complaint and the person responding was able to freeze my account, approved my claim, and refunded any NSF fees (they kept attempting to take more). But I have no doubt if it was not hundreds, but thousands of dollars in question, they would have fought it until the bitter end.

On the plus side, I did get the $500 bonus but the stress was not worth it.

I really hope they get hit by a class action on this.