Citibank maintains poor security protocols, causing millions in losses for account holders, suit by state claims.