In two of the cases mentioned in the article, Citi approved multi-tens-of-thousand-dollar wire transfers from consumer accounts without getting positive confirmation from the customer. And in one case, the customer themself contacted Citi after clicking a sketchy link. That’s pretty egregious IMO.