When a customer has their card stolen and numerous ATM withdrawals and PIN debit transactions show up, what can we do to investigate? Our processor always says since its fraud we're stuck, but can we request footage of the person using the ATM at least? Some are done at an ATM in a Wal-Mart.

Since they were PIN based, your processor is correct, you cannot file chargebacks. You can try to work directly with the merchants...some may require that the request come from law enforcement so you may need to contact the local PD for help.

As for your customer, since the card was stolen, and ATM withdrawals are not covered by Zero Liability, their liability would be based on Reg E 1005.6 and how soon after they discovered the card missing that they notified the institution.

The obvious question for your customer as part of your investigation is, "How did the thief know your PIN?"

Could have been written on the card, shoulder surfed, phished, etc. If you consider this customer a risk, you may choose not to reissue a card to them.

Thanks.

A client was incarcerated and claimed his card was stolen from his family members house while he was in jail for two months. In this case, the report of a stolen card came in well past the two days to limit the liability and whomever took the card withdrew several thousand dollars between ATM withdrawals & POS transactions. The client became aware after the two months of activity.

A careful reading of the two-day window in 1005.6 will show that the Reg starts the clock on those two days ticking when "the consumer notifies the financial institution within two business days [i]after learning of the loss or theft of the access device"

Unless the cardholder notified you more than 60 days from the transmission of the statement on which the first unauthorized charge appeared as provided in 1005.6(b)(3) the cardholder's maximum liability is $50.00. This could be further reduced in the event all of the unauthorized transactions are covered by MC/VISA Zero Liability protections.

Liability under 1005.6(b)(1)and (2) assumes the cardholder learned of the loss or theft of the access device. You've said that the client learned of the theft of the card after two months of unauthorized activity. That would mean that the first knowledge trigger for liability is the sending of the statement reflecting the first unauthorized use, and there's no liability at all until the 61st day following the sending of that statement.

Short version: The $50 rule doesn't apply; the $500 rule doesn't apply. The cardholder isn't responsible for any of the unauthorized activity until the end of the 60-day post-statement period.