If you had a hunch that Citibank’s credit card division wasn’t terribly good at its job, you were right. Citi sold credit card debt to buyers with inflated interest rates, failed to tell those debt buyers when it accepted payments on these cards after the debt had been sold.

This is all according to the Consumer Financial Protection Bureau, which today announced brought an action against Citi, claiming that the bank spent years selling credit card debt to buyers without provide accurate information on interest rates or alerting debt buyers to post-purchase payments made by the account holders.

Inflated Interest

The CFPB contends that, between Feb. 2010 and June 2013, Citi overstated the interest rates on nearly 130,000 card accounts that it sold off to 16 different different debt buyers.

The bank wasn’t checking individual accounts against the info it sold to the buyers, and didn’t provide any supporting documentation that contained this information. If debt buyers tried to acquire account-level info after purchasing a debt, they were charged fees at $10 per page by Citi.

That means that these people were accruing interest that was sometimes much higher than what they should have been hit with. The information was so bad that some accounts were charged upwards of 29% APR when they were supposed to be accruing no interest at all.

As a result of these overinflated APRs, debtors paid nearly $5 million more than they should have during those years. Thus, under federal law, the debt buyers were engaged in a deceptive practice, and Citi violated the law by “knowingly or recklessly provid[ing] substantial assistance” in the form of the inflated interest rates.

Payment? What Payment?

Between 2010 and 2014, the CFPB says that Citi received hundreds of thousands in credit card payments from credit card customers whose debt had already been sold off, but failed to tell the debt buyers about this or delayed remitting the money to the debt buyers.

For example, in 2012, Citi sat on more than 4,000 individual credit card payments — totaling nearly $225,000 — for more than 91 days. Without that information or the payments, the debt buyers were unable to update customer accounts in a timely manner. So debtors paid more than they should, and some were likely sent to collections or sued when they shouldn’t have been.

The CFPB contends that this constitutes an unfair act or practice in violation of federal law.

Time To Pay

As part of the consent order [PDF] in this matter, Citi is required to refund an estimated a total of $4.89 million to roughly 2,100 consumers.

The bank must also provide full and accurate documentation for the debts it sells off. This includes the credit agreement and recent account statements.

If Citi can’t provide this information, or if the debt can’t be verified for other reasons — the customer alerted the bank to possible identity theft or unauthorized use; the customer has sent a written statement disputing the amount owed; the account is within 150 days of the end of the statute of limitations — Citi can not sell it.

Additionally, in order to prevent further erosion of documentation and info, Citi’s contracts with debt buyers must prevent the buyer from reselling the debt.

And the cherry on top: Citibank must pay a $3 million penalty to the CFPB’s Civil Penalty Fund.

Want more consumer news? Visit our parent organization, Consumer Reports, for the latest on scams, recalls, and other consumer issues.