While I haven't had any dealings with Citi on fraud prevention, I can say that I've had similarly intrusive questions with other financial institutions. It seems to be that in the age of data mining and social media, they dig up a lot of information that you haven't expressly provided.

I was asked to prove my identity by providing a) the year my house was built b) my sister's date of birth and b) my home address from two residences ago. I sincerely could not answer any of those questions.

Despite my sister having a different last name, they still knew who she was and that we were related. Calling her would've been a bit weird, but this seems to be the direction things are moving.