3/17 customer reports unauthorized trx on his card dated 10/10, 11/7, 11/18, 1/4, 1/10. Are we liable for the transactions that occured in Oct/Nov?

Additional information might rule them out, but if there was no loss or theft of the card involved, my answer would be "Yes." See the rules for determining the customer's liability for unauthorized EFTs in section 1005.6 of Regulation E.