customer files fairly large eft...we investigate and come back with the name of the person who initiated the transactions. Asked the customer if she knew who it was...yep...that's my son! He's grounded for life...but she's not withdrawing her claim. Are we liable?

If your investigation determines that you customer did not authorize the disputed transactions,Reg E requires that you reimburse the customer based on the liability schedule of 1005.6. Although you cannot require the police report, you can advise her that the bank will prosecute the their to the fullest extent of the law to recover the funds. She may or not withdraw with this knowledge, but you must be prepared to carry through on your promise.

And you might want to rethink giving her a replacement card.

We are in the process of writing an article for our newsletter about Error Resolution Myths. One of them is this:

5. If a family member used the card, it is authorized.
If a family member uses a customer’s card it may not be authorized. Let’s take a look at a scenario:

A mother is pulling cash out of the ATM using her debit card. While this is happening the daughter oversees the PIN entered into the ATM. At a later date the daughter takes the card out of the mother’s purse with out permission and accesses the account for $100. This would not be an authorized transaction based on the Commentary to §1005.2(m) #3:
An unauthorized EFT includes a transfer initiated by a person who obtained the access device from the consumer through fraud or robbery.

Remember, Regulation E states that negligence by the consumer cannot be used as the basis for imposing greater liability than is permissible under Regulation E.
The Commentary to 1005.6(b) #2 states:
Negligence by the consumer cannot be used as the basis for imposing greater liability than is permissible under Regulation E. Thus, consumer behavior that may constitute negligence under state law, such as writing the PIN on a debit card or on a piece of paper kept with the card, does not affect the consumer's liability for unauthorized transfers.

However, if I take my card out, hand it to my family member, tell them the PIN and ask them to run to the ATM because I'm too busy or lazy and ask them take out $20.00 but they take out $200.00 and pocket the $180.00.........

. . . then $200 is authorized.

In that situation Reknab, we would tell the mother she gets her money but since we would be taking a loss, we will fill a report with the police and prosecute. A lot of the time that will help to convince the "victim" to rethink it...