Citigroup sued by N.Y. attorney general for failing to protect customers from scammers