NY attorney general files lawsuit against Citibank for failing to protect customers from online fraud