We have a member who has reported many unauthorized ATM withdrawals since June 25. 13 unauthorized withdrawals were reported totaling over $3100 dollars. She reported the unauthorized withdrawals on three seperate occasions. Here is a list of report date and withdrawals reported:
Report Date Transaction Date
8/22- 7/31

9/16- 9/3, 9/12

9/29- 6/25,7/3,7/17,8/9,8/18,8/20,8/23,9/6,9/13


The member learned of the activity reported on 8/22 on 8/5.

The member learned of the activity reported on 9/16 on 9/16.

The member learned of the activity reported on 9/29 on 9/24, although she called me on 9/26 and generally said money was missing w/o naming actual dates of unauthorized withdrawals.

I guess I am unsure if under Reg E. if each unauthorized transaction is treated as one occurance or if they could be thought of as 3 occurances, one for each time she reported it.

We are a smaller credit union and haven't really dealt with a situation quite like this and want to be sure we do not hold her liable for less than we should under law.

By the way, we have provisionally credited all reported amounts except the ones reported on 9/29 and we did do so well within 10 days. Any advice is greatly appreciated. I'll read more Reg. E. to try to figure liability out correctly also. Thanks.

I've come up with our member's liability will be for the withdrawals made on 9/6, 9/12, and 9/13 since those occured after 60 days from when her first staement showing fraud was mailed (July 4)

I also think the member will be liable for the withdrawal made on 7/31 since she realized the problem on 8/5 and waited until 8/22 to report it, much longer than her 2 day timely notice requirement.

Is this thinking correct? It seems like I'm still not certain this is correct.

Here's an idea, don't give her another card. Are these at local ATM's? If so, she probably has a bad family member.

I also wonder how on 9/16, they didn't realize the ones from the previous months.

Was all the fraud on the same card?

You were called three times, 8-22, 9-16 and 9-29. Each of these could have been a claim for different transactions that are reportedly unauthorized. But it looks like she is reviewing her statements well after the fact and finding more unauthorized.

The first call on 8-22 identified one transaction. Upon further review it should have been 7 as that is the number that happened up until that date.

The next call on 9-16 should have identified 5 that happened AFTER the first call.

If these are off one card, it should have been "hot carded" long ago so it couldn't be used for the second set. If it is off different cards, who is getting access to the card and PIN? Could it be internal theft or is it external? Is it the same card? Is her card being skimmed somewhere? When you interviewed the member, did you review past statements with her to identify the transactions she is suspect of?

I am thinking out loud here, but because of the time span between calls/claims I think you have three claims and three separate timelines on which to work. This means the customer also has three sets of liability they may owe.

I think you will have to mark out on paper each claim, the amounts, who owes what after your investigation is done and as noted, don't give this person another card, if that is the manner of accessing these.

This is also a weird pattern of debits. Some are a week apart, some a few days. If her card is being used, someone is stealing and replacing it. Where does she store it, who has access? A thief would use a skimmed card immediately for all they could believing it would be noticed, reported and hot carded. A family member or friend would take it, use it and put it back. Film will be very helpful if available. I'd also study the locations and times of the transactions if these are ATM. Is it anywhere your customer would have been, or a family member/friend?

The member also needs to review statements upon receipt and perhaps use internet banking or a telephone system to review her account more often.

Reg E issues aside, did you contact the bank where the fraudulent activity occurred? They might have a good picture of the person/car taking the money. You might be surprised what you see!

So Why wasn't the card cancelled when the first unauthorized transaction was reported?

All tranactions were moreless local, although the 7/31 transaction happened when our member and roomate were on a trip in Las Vegas. Pictures came back of 5 of the withdrawals from 1 ATM and our member confirmed this was the roommate.

No, my interpretation is that the credit union will suffer the loss on all transactions EXCEPT the ones that happened on 9/6, 9/12, and 9/13 and also EXCEPT the one happening on 7/31. The reason for the member having the loss on the September 6-13 fraud is because the statement showing the first fraud was mailed July 4 and those 3 fraud charges happened more than 60 days from July 4.

As the first withdrawal was reported, our member services office read it more like a ATM balancing problem and it did not make it to my office classified like a fraud. Since it sounded like a ATM glitch then, the card was not hotcoded.

On 9/16, her card was hotcoded after the 2 reports of unauthorized use happening 9/3 and 9/12.

Although we learned of many more unauthorized withdrawals on 9/29, they were not new ones that occured after her report on 9/16. They were old withdrawals made to her savings account that were not noticed at first since our member did not look at her savings account to notice these regularly, but usually only checked the balance in her checking account.

I'll lay you dollars to Krispy Kremes there is a lot more to this than what we're reading. The roommate was involved with one of the transactions. What do you suppose is the chance that roomie did more of these myterious withdrawals? I wonder whether, if you credit these funds back to your member and then take legal action agains the roomie, the roomie will "turn" on the member.

You may have already exhausted your ability to get pix of the other withdrawals. A lot of non-bank ATMs don't have cameras. But if you can get another of these fraudulent withdrawals tied to roomie, I think you've got a strong case to prosecute roomie for ATM card fraud. And you can even wonder if your CU member is in on the deal.

We assume and feel from past situations that the roommate is responsible for every disputed transaction, even if we may not have a pic yet. I wondered at first if our roomamte was in on the deal, but not anymore. I thought maybe her first conditional credit was given too easily, so she thought let me dispute more transactions for more money. However, since she was so reluctant from the start to accuse her roommate and she broke into tears today when she viewed the picture (which she brought her parents to view also), I really feel she was devastated to realize a close friend and roommate would steal that large amount of money from her and deny the charges, even when our member said that pictures would surface. Thanks for the input guys. I haven't figured out her liability yet and seem to think I've figured out Reg E, only to question what I just came up with.

It seems a little odd that your member's roommate knew the PIN. You may want to ask your member if she ever gave her roommate access to the card in the past, even months ago.

I'm not an expert on Reg. E so hopefully a Guru can give some input on this but the way I read Reg. E Sec. 205.2(m)(1) is that if your member ever gave her roommate access to the card (and PIN) in the past it is technically not an unauthorized ETF until she tells you that the roommate is no longer authorized to use the card.

If that is correct the credit union wouldn't be liable to the member at least for the first charges if she admits to ever giving her roommate access.

Just my opinion

I would ask the customer to file the police report, however, as soon as you credit her and your institution is in the loss position you can file the police report and begin to prosecute the roommate.

Thanks. The report has been filed and I figure the roommate got the pin 1 of 2 ways.
In the first case, maybe our member gave her the pin, even only once, making her an authorized user of the card until our member changed the pin or told us otherwise. Our member has not said that to be true and she has no idea what difference giving the pin once would make in the case.

Until I can talk to the suspect, I think it is more likely that the suspect observed our member enter the pin at some point, perhaps at a PIN pad at a restaurant or maybe by over the shoulder surfing at a walk-up or drive thru ATM. Then the suspect probably memorized the number and waited for an opportunity to take the card, use it to withdraw money, and put it back, many times so our member never really noticed it missing.

I've been in touch with the police and will register us as a victim in hopes of restitution upon conviction. I think it's unlikely the suspect can repay us the loss directly to avoid the police making an arrest.

Thanks for the input. I think I've finally figured out the member's liability here, assuming she did not give the suspect the PIN number.

She looks to be liable for the transactions happening on 9/6, 9/12, and 9/13 due to 205.6b3

And also $50 because of 205.6b2i

And lastly the transaction made on 8/18 because of 205.6b2ii

Is there anyone here that can confirm that liabilty?

I forgot to sign in when I responded above. Sorry.

Just to clear up something here. If your member gave the card and PIN to the roomie for one authorized use and got the card back, the authority stops when the card is returned to the member. If the card is "lifted" again by roomie (without authority), it's unauthorized because use of the card by theft simply cannot be authorized. The rule about giving the card to someone and the authorization extending until the bank is notified doesn't cover the situation when the card is returned to its cardholder and then lifted again.

Then what is the point of the rule? We have always interpreted it as authorization is eternal until revoked. Getting the card back doesn't mean you don't want them to ever use it again. If you interpret it that way you open the door for a lot a losses.

Original Anon. poster here (#437063)

John-
Thanks for clearing that up. I gave someone the same response three months ago and I was right in that incident. I understand what you're saying and if I would have gone back and read Andy's reply in that thread, I wouldn't have passed along the bad information.

Well, the problem is there are two rules under the discussion of unauthorized electronic fund transfer (UEFT). One is the one you have described. The other is the rule on UEFTs with access devices obtained by robbery or fraud (that one's in the Commentary, by the way).

Regulation E is a consumer-protection regulation built on a consumer-protection law. Confronted by these two apparently conflicting rules, which one do you suppose will be given the most effect by a court?

As long as you understand there are two sides to this discussion, your institution is free to decide which side to accept.

By providing the PIN, when the authorized user exceeds their authority the bank is not liable. That part of the rule protects the institution. It is really one of the few, in a way, and it is often over relied upon and bad calls are made because of it. So it does help you. John gives me his card and PIN. He asks for $200. I take $400. John controlled the situation, the bank doesn't lose. If I take the correct amount, return the card but later steal it back and use it, John did his due diligence and secured the card. I stole it. Now the bank has liability. And yes, he gave me the PIN, but remember he can't have liability increased even if he wrote the PIN on the card. He didn't do that. He gave it to a friend. So he was trying to be safer.