We have a third party that watches for fraud on our ATM/Checkcards and they notify us when a transaction looks like fraud on our customer's account. In some cases the fraud has been confirmed by the customer, and in some cases they are still trying to contact the customer. Does our time frame for beginning the investigation start with the notice from the third party or when our customer contacts us? There have been some cases where our customer never contacts us because they think that the third party notice to us is all they need.

If this service is promoted to your customers as acting as "eyes and ears" for the customer, I believe your customer's expectation is that the service provides the notice on their behalf. While there is nothing specific in the regulation indicating that notice by a third party constitutes notice under 205.11, I think you could make a strong argument that this service acts as your customers' agent in these cases.

If, on the other hand, you don't promote the service, and it's duty is to you (and not the customer), I think you treat a notice as knowledge obtained by the bank on its own, which still requires that you correct the error, but does not subject you to the rigors of complying with section 205.11 rules.

I would hope that the third party service tells the customer that this does or does not constitute notice and if it doesn't, that they should report it and possibly how. This procedure should mitigate any risks.