[Resolved] Citizens Bank / concerns with citizens bank security policy and implementation

Providence, RI, United States
Contact information:

I have multiple accounts with Citizens Bank and have had a relationship with Citizens Bank (and prior to that with Mellon Bank) for over 44 years.
I can not obtain information from Citizens Bank regarding basic, simple information related to your security policies and their information as it impacts my personal information. An email was sent at the suggestion of a Citizens Bank Customer Services representative on 9/18/2017. The Citizens Generating server,, identified that delivery has failed to these recipients or groups:

There's a problem with the recipient's mailbox. Please try resending the message. If the problem continues, please contact your helpdesk."

I attempted to send again and received the same message.

Today I attempted to obtain the identification of who or whom at Citizens I could send this information request and was told that there was no email address that was valid for this type of inquiry, unless I used Citizens On-Line Banking, which I do not use. No department or other Citizens Bank organization was able to be identified. And, I have chosen not to contact Brian O'Connell, EVP Technology Services Citizens Financial Group, but I am sure at least he or his staff could point me in the right direction.

That conversation today with Citizens Customer Service was another 40+ minutes of wasted effort as there are none so far from either Citizens branch operations or Customer Services that can address my concerns and questions, and provide honest, complete and accurate response.

The email I sent to Citizens will be sent in a separate Compliant Registration form as you have a limit on the size of communications to Citizens.

I request that I be able to speak with someone that can assist me in understanding your Customer Service approach so that if I have other questions I know where to seek resolution.

Thank you.

Frederick A. Arnold
2507 Clayton Road
Beaver Falls PA 15010
[protected] (mobile)

  • Resolution statement

    Complain resolved by Citizens Bank management. This should have never been posted as it was believed to be a Citizens' website as per statements from Citizens Bank customer service, and that this was a pop up while on the Citizens Bank website. It is interesting in that there is no information about the Complaint Board and that they just seem to be an offshore posting service making money from their advertisements: they serve no useful purpose.

  • Updated by Frederick A. Arnold, Sep 19, 2017

    The following is an email I sent to Citizens Bank at the request of Citizens Bank Customer Service, however it was returned by the Citizens Bank server.
    The email is as follows:
    8:51 PM (22 hours ago)
    to [protected]
    The Problem
    A series of recent communications with Citizens Bank has been coupled with recent security events that have increased my concerns with Citizens Bank security policy and implementation.

    I have attempted to get a better understanding of how Citizens Bank approached security topics but can get neither information nor answers from the local branch personnel or from the Citizens bank Customer Service personnel.

    My concerns were initiated earlier this year when Citizens contacted me to discuss potential renewal of a home equity line of credit that we had in place for about 15 years. Initially I had determined that I did not need this as I had never used it, and did not foresee future use. During conversations about this loan vehicle I had certain questions that were not able to be answered by Citizens personnel at my local branch in Chippewa/Beaver Falls PA or in either your Columbus OH or Rhode Island offices.

    It was obvious that information was not easily available within Citizens systems. During this time I was in Arlington VA for meetings and received a call on my mobile device from Citizens actively trying to close the home equity line of credit in discussion. When I asked if they had the answers to my questions the Citizens personnel stated that they did not and when I asked about my accounts they then stated that they were not able to discuss my accounts with me due to security reasons. I also learned that the Citizens personnel calling me were from a Citizens Bank facility in Panama City, Panama.

    Next I received and reviewed a credit report sent to me from Citizens that was developed by Equifax. I was also interested in the lack of accurate information in the report but was told that my wife and I had excellent credit ratings. I had not previously received or reviewed a credit rating report but was interested in the quantity of information reported.

    I also received correspondence from Citizens Bank identifying certain summary information/notice about how Citizens approached protecting my information from unauthorized access or use. That caused me to read the notice in detail and I was again surprised by the lack of information provided by Citizens to its customers about the sharing and management of customers' personal information.

    Lastly there was the report of the security breech at Equifax and the related delayed public reporting by Equifax, the reported actions by Equifax leadership to sell their Equifax assets prior to public disclosure of the security issues, the reported resignations of the Equifax CISO and CIO, and finally today's identification that the personal information of my wife and I was identified as being believed by Equifax as being compromised during the security breech.

    Based upon the above evolving situation and the continuing emergence of new information related to the adequacy of Citizens Bank actions to prevent unauthorized access or use of my information I have quickly summarized my questions. The Citizens Bank representative today stated to me that it may be best for me to ask you to address these issues as they had no specific information to share with me. My questions are as follows:
    · Citizens references that they share information with its affiliates and nonaffiliates as well as those with whom Citizens has joint marketing agreements. Please identify to me the nonaffiliates and joint marketing firms with whom Citizens has provided and is providing my personal information. I also request Citizens to identify the purpose of sharing my personal information with each of the organizations.

    · Does Citizens accept liability of the failure by its affiliates, nonaffiliates and joint marketing firms, with whom Citizens has shared my personal information, to properly protect and maintain my personal information should these firms directly or indirectly by their actions or failure to take appropriate actions to protect against unapproved access or use of my personal information?

    · Citizens Bank has identified to me that certain of its operations involving my personal information are performed from Citizens Bank facilities located in Panama City, Panama, and perhaps in other locations outside the United States. What security controls are applied to these operations? (Many years ago when I led IT projects for a large global IT services firm we had established certifications of our offshore facilities – SEI CMMi and versions of BS 7799, and had independent IT security audits of our facilities performed for our private sector clients.) Does Citizens Bank have established similar security controls? (My concerns are further highlighted by industry information reporting that according to PWC's Global State of Security Survey 2016, cyber-attacks on businesses, institutions and individuals increased 38% last year compared to 2014.)]]

    I am not a security professional but have experience in establishing certain security policies and programs and their implementation, and in providing independent oversight for private sector and federal clients of security programs implemented by others. I also have a 44+ year relationship with Citizens for which I have no current desire to end. You know your systems and operations: I do not. Your review and response to my concerns and questions above is requested.

Sep 19, 2017

Post your comment