Citigroup’s $900 million mistake