Given the apparent scope of the fraud, Litan pointed to card skimming as a likely cause.

Card skimming involves the use of illegal card-reading devices that intercept and record data stored on magnetic strips on credit and debit cards which are then later used to create counterfeit cards. Such devices, which have long been used to steal card information in places such as restaurants, have been proliferating widely and have made skimming one of the most prevalent forms of credit card fraud these days.

In fact, skimmers were believed to have been behind a massive credit card theft in December involving wholesaler Sam's Club, a division of Wal-Mart Stores Inc.

In that incident, card skimmers were thought to have used skimming devices at Sam's Club gas stations to steal debit card information from potentially thousands of consumers. At that time, Sam's Club acknowledged that a breach had taken place, but did not disclose what exactly transpired saying only that "electronic systems and databases used inside its stores" were not involved.

Litan said it is likely that Citibank's current ATM fraud problems are related to the Sam's Club breach.