Citi, the nation's largest bank, is issuing 3.5 million credit cards to department store customers who didn't request them — a step that consumer groups say raises privacy concerns and could expose consumers to identity theft.

This month, Citi is sending general-purpose MasterCards to Macy's customers with credit card accounts that have been inactive for two to four years. Citi bought those credit card accounts last year.

Citi and Macy's describe the new cards as a way to "replace" inactive Macy's accounts. But the new Citibank MasterCards aren't Macy's-branded; they can be used anywhere MasterCard is accepted. Macy's cards can be used only in-store.

Consumer advocates worry that automatically sending cards to consumers — rather than doing so only if they request the cards — could expose consumers to information-stealing scammers.

"In my view, it's a privacy violation and a customer violation," says Mari Frank, author of "Safeguard Your Identity." "Privacy builds trust. Lack of privacy destroys trust."

Samuel Wang, a Citi spokes-man, says customers were notified about the cards in advance and must activate them to use them. Wang adds that even in case of fraud, customers wouldn't be liable for the charges.

Wang wouldn't say how many of the millions who received the cards have activated them.