Bank had multiple customers who were victims of the massive VISA debit card breach earlier this year. Bank procedure is to send all disputes to our processor for investigation and issue notices stating provisional credit has been given. This was done on all the VISA debit card disputes the bank received. Regardless of the outcome of the investigation, the Bank will eat any losses incurred from the breach, we will not pass any losses on to our customers. According to Reg. E our processor has 90 days to complete the investigation on these card disputes.

Even though the investigation is not yet completed on most of these disputes could we go ahead and issue another notice to affected customers telling them provisional credit has been made final? Or are we required to wait until the investigation is completed (even though the results of the investigation will not change the fact that we are making the provisional credit given to the customer final)?

If a decision was made prior to issuing the provisional credit that the bank would eat the loss, I would have issued final credit to begin with. You are creating double work.

That said, I would recommend investigating to ensure that the reported error was indeed related to the breach and not something for which the customer should be responsible. Obviously if there is some type of pattern to quickly determine it is related, an investigation may not be necessary. Just issue final credit.