Did Citibank handle this situation correctly?