Citibank Costco Anywhere card program connection does not surface child cards for assignment in New Expensify or Classic

[m-natarajan]

If you haven’t already, check out our contributing guidelines for onboarding. To join our Slack channel, fill out this form.

---

Version Number:
Reproducible in staging?: Needs Reproduction (Reproduction blocked- Needs associated child card)
Reproducible in production?: Needs Reproduction
If this was caught during regression testing, add the test name, ID and link from BrowserStack:
Email or phone of affected tester (no customers):
Logs: https://stackoverflow.com/c/expensify/questions/4856
Expensify/Expensify Issue URL:
Issue reported by: @PedroEspinoza1999
Slack conversation (hyperlinked to channel name): #Expensify Bugs

Action Performed:

1. User attempted to connect/import the Citibank Costco Anywhere Business Visa card program in New Expensify.
2. Navigated to Workspaces > Company Cards > Add Cards > Direct Feed.
3. Selected Citibank / Citi direct feed options and authenticated using the parent/master card credentials.
4. The connection completed, but only one card appeared.
5. User then tested the same connection flow in Expensify Classic through Settings > Domains > Import Card.
6. User authenticated again using the same parent/master credentials.
7. The feed wasn't created on Classic.
8. User also tested in Google Chrome to rule out a browser-specific issue, after initially testing in Microsoft Edge.
9. The same behavior occurred in both browsers and both platforms.

Expected Result:

The Citibank Costco Anywhere card feed should surface all available child/employee cards under the parent card program so the admin can assign the correct cards to the appropriate cardholders. The parent card should not be the only available card for assignment.

Actual Result:

Only the parent/master card appears during the connection/import flow. The child/employee cards do not appear for assignment in either New Expensify or Expensify Classic, even though the user confirmed the card program is a Costco Anywhere / Citi Business Visa program and cardholders have recent activity.

Workaround:

Unknown

Platforms:

Select the officially supported platforms where the issue was reproduced:

• Android: App
• Android: mWeb Chrome
• iOS: App
• iOS: mWeb Safari
• iOS: mWeb Chrome
• Windows: Chrome / Edge
• MacOS: Chrome / Safari

Screenshots/Videos

The video for the issue is in Slack thread

View all open jobs on GitHub

[MelvinBot]

Issue Analysis

Summary: This is a company-card feed issue, and the behavior lives in Expensify's backend card-import/feed services — not in the Expensify/App (frontend) codebase. So there's no App-side code fix to make here; the analysis below places the cause and points to the right escalation.

What's happening: The admin connected the Citibank Costco Anywhere Business Visa program using a Direct Feed (bank OAuth/direct connection) and authenticated with the parent/master card credentials. A direct connection authenticates as a single cardholder/account, so the assignable-card list is built from the accounts the bank's direct API returns for those credentials — which here is only the parent/master card. The child/employee cards under the business program are never returned by the direct connection, so they don't appear for assignment. This also explains why Classic showed the same result (both platforms hit the same backend feed), and why swapping Chrome ↔ Edge changed nothing (it's not browser-specific).

Most likely cause (two buckets to confirm with internal tooling):

1. Bank-side (most likely): Citi's direct connection only exposes the authenticating account, not the full child-card hierarchy of a business program. For multi-card business programs, the reliable path is a commercial feed (Visa → VCF), which the bank delivers as a file containing all child cards — not a self-serve direct connection.
2. Our post-processing (less likely): the assignable-card list didn't fully refresh, or child accounts were filtered/not matched during import.

Recommended next step for the customer (works today): Set up a commercial Visa (VCF) feed for the Costco/Citi program instead of the direct feed. Commercial feeds surface every child/employee card for assignment. This is arranged through the banking contact / commercialcards@expensify.com, then the feed is imported in Expensify.

Recommended next step for verification (internal engineer): Because the root cause is in backend feed services (not App), an internal engineer should:

• Check the raw feed / account-list data actually returned by Citi for these credentials to confirm only the parent account was returned (bucket 1) vs. child cards returned but dropped (bucket 2).
• Pull the connection/scrape logs for the cardholder + feed to read the final scrape result and the account list.
• If child cards were returned but not surfaced, this becomes an internal Expensify/Expensify bug (labels Scraper + Commercial Cards).

Related open issues (same direct-connection / card-assignment theme)

• Expensify/App#95069 — Card connection reauthorization must be initiated from the parent workspace to assign new cards
• Expensify/App#93328 — AMEX direct connection - unable to assign a new card

These are separate root causes but the same broad area (direct/OAuth connections not surfacing all assignable cards). Worth cross-referencing when the feed team looks at this.

Confidence: Medium on the categorization (direct feeds surface only the authenticating account; commercial feed is the multi-card path). I could not verify against production logs or the raw Citi feed data from here — that requires the internal card-feed tooling noted above. No App-side code change is applicable.

---

Next Steps: This needs an internal engineer with access to the card-feed backend to confirm bucket 1 vs. 2 and, if it's a backend bug, file it in Expensify/Expensify. Reply with @MelvinBot <feedback> to refine this analysis.

[melvin-bot]

Uh oh! This issue is overdue by 2 days. Don't forget to update your issues!

[melvin-bot]

Eep! 4 days overdue now. Issues have feelings too...

[melvin-bot]

Still overdue 6 days?! Let's take care of this!

[melvin-bot]

10 days overdue. Is anyone even seeing these? Hello?

[melvin-bot]

12 days overdue. Walking. Toward. The. Light...

[melvin-bot]

this issue was created 2 weeks ago. Are we close to a solution? Let's make sure we're treating this as a top priority. Don't hesitate to create a thread in #expensify-open-source to align faster in real time. Thanks!

[melvin-bot]

This issue has not been updated in over 14 days. eroding to Weekly issue.