So there has to be a point where the bank isnt at fault. Where you gave your OTC code to the guy anydesked to your PC and approved the transfer verbally.

I dont know about the citibank case, but the Australian government is teasing laws that will make the bank 100% liable in all fraud cases, responsible for 100% refunds. The idea is that this will incentivise the banks to build idiot proof security. I think it would more likely incentivise them to only have non idiot customers.