Nine years later, Citibank’s fraud department is still self-defeating