This went much smoother than I expected.
Leslie from the old tradeline company contacted the AU. The AU said that they saw it on their credit report, assumed it was fraudulent, and tried to remove themselves from the card. She said that it didn't seem like the AU fully understood how the tradeline process worked.
I doubt there is anything a tradeline company can do to prevent something like this from happening. She didn't say whether something like this had happened before, but she said it is very uncommon. This is how they've handled it.
"contacting the lenders is strictly against our policy and voids their contract...we have a 0 tolerance policy...They will not receive any refunds or be able to place any future orders"
She's also going to put my Citi cards on hold for a couple of months to be safe.
Leslie assured me that there was no way for the AU to get my name from the tradeline company or the credit report. The credit report would only show the credit card issuer and possibly the card holder's address. She was able to check the AU's Experian credit report and my address is on it. The AU was added on 7/19, my statement closing date was 7/25, and it showed up on her credit report on or before 8/23. So it showed up after just one cycle. She said that she didn't think that Citi would give the AU my name, but that it is possible because of human error. She theorized that the fraud specialist meant that the AU didn't know what my name was, not that she didn't recognize my name. It's also possible that that's what they told me and I just misunderstood them. So either Citi didn't actually give the AU my name or they failed an unintentional social engineering test. After the dust settles, I might call Citi back and try to get some answers about whether they gave the AU my name.
Leslie recommended that I just use the secure message to remove the AU instead of calling Citi. Since I knew what had happened, I decided to go ahead and call them. It didn't seem like just removing the AU would remove the alert and I figured I could talk my way through it. After answering all their questions they removed the fraud alert from my account. In case anyone else runs into a similar situation, this is what they asked me:
1. They asked more than the normal amount of questions to verify who I was. Including questions about my other Citi card that wasn't involved in the "fraud".
2. Why did I end the call the previous day? - I explained that I wanted to contact the AU about it
3. What is my relationship with the AU? - Business Associate
4. Why didn't the AU didn't know who I was ?- I basically said "I don't know" and the fraud specialist laughed it off.
Can you remove an authorized user from Citi via secure message? Has anyone tried and succeeded in it? Thanks.
Coincidentally, the old company addressed this during our communication. If this is correct, then using a secure message should work to remove a tradeline for any issuer.
"All I would advise you to do is to email Citibank using their secure email function in your Citibank portal asking them to remove the AU from your account. There's an example of removing an AU online in the attached Adding AUs pdf. Due to ADA regulations, bank issuers have to accept secure messages the same way they would accept phone calls"