Citi’s $900 million Revlon gaffe risks getting even more painful