I know that we have had a fairly extensive discussion on timing issues for Regulation E liability. This question involves both the timing issue associated with liability and the substantive issue of liability. Customer claims that from December until February, her boyfriend used her access device without her authority. Our cameras (at our ATM) show that he used her access device to withdraw cash on a regular basis. Customer waits until three weeks ago to file an unauthorized-use claim with us.

Our initial inclination was to contend that she failed to timely notify us and as such we wanted to deny the claim on that basis. However, after doing some research we concluded that the Section 11 error resolution rules govern when we receive a timely notice. The rules do not necessarily affect our liability. Is that your understanding?

Secondly, as indicated above, we investigated and determined that the boyfriend used our ATM with her access device -- and that he used her PIN to obtain the cash. We cannot fully assert that the boyfriend had authority -- she now claims he did not have authority to do so -- but we can deduce that he was withdrawing cash for several months while we were mailing her statements. This would suggest that she knew someone was withdrawing cash from her account on a regular basis.

We have had some "friendly fraud" cases like this. How do people handle these scenarios? She has signed an affidavit alleging that she did not provide her PIN to anyone. While we have not talked to the boyfriend, the police report (she called the police) contains his statement. He denied accessing the account (even though our cameras have a clear shot of him) via ATM. He did say that our customer allowed him to use her ATM/debit card to make purchases. I'd appreciate any assistance on this difficult Reg. E issue.

Timely notice and liability are two different parts of Reg. E. John and I recently started to debate this and found we agreed. While that doesn't make us right, we agree and that is a good thing. You may have seen that thread or can easily find it with a search.

Initially I would have tried to get her to admit that at some time she gave him the PIN. That would be your out. But if she contends she didn't, and he will not admit to that either, then she:
* didn't do the transaction
* didn't authorize the transaction
* didn't benefit(???) from the transaction

She filed a PD report to this effect and he isn't saying she asked him to make the withdrawals. You are going down the path of a valid love dispute, oh, minor slip there, a valid claim.

The fact that you delivered statements is irrelevant in the investigation although it influences liability. She had the opportunity to read them, but did she, did he handle that for her or dispose of the statements? The answers are moot. These are meant to provoke thoughts.

Any pics show he and she together, in a car, standing by each other, etc?

Here is what I would do:

I would believe my customer and resolve the dispute in her favor and make sure the boyfriend was charged with fraud. If the police do their work, the boyfriend will be arrested. It would go to court and if the boyfriend was found guilty, he would be ordered to pay restitution. If the boyfriend could prove otherwise, then I would have a talk with my customer who signed the affidavit.

No. We don't have any pictures of the couple standing together near the car. And, she has always denied that she gave the PIN to her boyfriend. Normally, we would process this claim as unauthorized. Unfortunately, in this case we are talking about a large amount of money. So we are exploring whether we can deny the claim on the ground that she authorized the transactions.

What about the PIN-based nature of these transactions? I know the OCC has issued guidance frowning upon denying a claim soley because the perpetrator used a PIN. In this case, we know the perpetrator used her PIN and the ATM that she frequently used. We also believe that the couple lived together while this occurred.

I guess another path would be to evaluate whether they participated in some large purchases -- furniture, downpayment on a house, etc. -- together while they lived together and whether she made ATM or other cash withdrawals from the account during the three-month period. Any other ideas?

kansayaku is correct. The Reg even says, (in other words than mine) that if the customer is stupid and can't remember their PIN, writing it on the card is allowed but there might be a small price to pay.

This doesn't change your equation. Your claim is looking dim.

§205.6 OSC (6)(b) 2. Consumer negligence. Negligence by the consumer cannot be used as the basis for imposing greater liability than is permissible under Regulation E. Thus, consumer behavior that may constitute negligence under state law, such as writing the PIN on a debit card or on a piece of paper kept with the card, does not affect the consumer’s liability for unauthorized transfers.

Yes, I am aware of that language. Our argument is not that our customer was negligent. We are trying to assert -- without much success, yet -- that our customer authorized the transactions. I am not yet certain how this will work, but I suspect that we'll point to a variety of factors, including:

-- the nature of the relationship between perp and victim
-- the promptness of the claim
-- customer's pattern of ATM use (and whether the "authorized" occurrences dropped when the "unauthorized" occurrences took place)
-- our customer's location when the withdrawals occurred.

I know it's a longshot, but we have to closely investigate this claim, given its size. Thanks for your help. If anyone has any other ideas, feel free to let me know.

Proving your customer's whereabouts at the time of transactions may be difficult.

On the other side of the coin, if you deny the claim, the customer may complain to the media. You'll have some reputational risk there. She may complain to your regulator. They may ask you about the claim and to defend your position. I don't know that they would tell you you have to pay it. (If they hear this repeatedly, expect a detailed review of claims on your next exam.) Leaving an attorney as her last resort.

You may stick your toe in the water so to speak and see if she walks away saying it was worth a try, or wanting to pursue it another way, such as I mentioned above.

Don't deny it because you don't like it, regardless of what the facts support. Know your position is strong, document it and do what you feel is correct and legal.

I still say pay the claim and have her arrest the boyfriend. You have pictures showing the boyfriend using the card. You have the customer's statement saying he was not authorized to use the card. Get the police involved. If he can prove he did have authorization, then she is in big trouble. I have 2 fraud cases going on now. With one case, the person is in jail and waiting a preliminary hearing. The other case, the person was found guilty and has to pay restitution. It may take years for the bank to recover it but I'll bet that person will never commit debit card fraud again. It was worth it for me to attend the hearing and watch them bring the person up to court in handcuffs. What a message to send out to others attempting to do the same.

When you pay the claim you should step into her shoes. So you go to law enforcement.

Your point on the years it may take to get restitution is well said. And a deterrent toward that action. The claim should be paid or denied based on the facts of the claim, not collectability.

Another question is how vigorously it will be prosecuted. One of my banks is on a military post. This involves the US Attorney's office and or FBI on many occasions. They are busy enough that if you don't hand them the slam dunk or you don't meet a high threshold, don't hold your breath.

My opinion is you have to pay the claim. You have proof "camera" the boyfriend used the card. She said on a written affidavit that she did not give him or anyone her PIN. She filed a police report.

If you could get her to say she gave him permission once a long time ago, you would have a reason to deny the claim but she said she never gave him the PIN. Remember that if a customer gives authority (even once), they have to send a written statement to the bank taking away that authority. Other than that, I think you have to take the loss.

As said in previous discussion above, she could take you to court but she could also write a letter to the OCC or your regulators. I have to tell you that a while back, I had a customer "from another bank" call me asking my opinion. She told me that her bank refused to pay a claim. She asked my opinion on what she could do. I told her the Reg E rules and told her that if she felt the bank violated those rules to contact the OCC. She did and the other bank paid the claim plus interest. I follow Reg E and call it "the cost of doing business". That doesn't mean I have to like it.

I guess I’ll be the voice of dissent on this one. There is no way we would pay that claim. Our depository agreement clearly limits our customers to “60 days after the statement was mailed” to inform us of unauthorized transactions, “unless extended hospital stay, illness, prevented you from telling us”. Our lawyers in all of our states have approved this, and we have never had a problem with it. Further, we would not be scared of someone going to the media with this. If it got to the media on a terribly slow news day, I believe that the “average Joe” would agree with the bank when they heard her ”Boyfriend” claim..But, again, this is just what my bank would do..If your agreement is not clear, then I would definitely have your lawyers review the options for your bank.

Chris, as you stated it here, if I don't tell you within 60 days of the statement date, you place all the liability on me. That is not in accordance with Reg. E as I read it and I'd urge you to have knowledgeable counsel revisit this.

§205.6 A consumer must report an unauthorized electronic fund transfer that appears on a periodic statement within 60 days of the financial institution’s transmittal of the statement to avoid liability for subsequent transfers.

You are placing more liability on the consumer than the Reg. allows and you can't do that either.

Assuming there are unauthorized transfers here (and that is in dispute), our bank's liability would be limited to the first sixty days following the periodic statement distribution. After the sixty-day period, we are not on the hook.

You are correct in the 60 day period, after that the customer's liability is unlimited. You said they were quite large. She should have a some point noticed her balance was quite a bit lower (our ATM receipts have the balance, so if she used the ATM she would have known the balance was lower). Ask her if she allowed him to make purchases using her card (like he stated). If she states that is true, ask when. At that point he would have been authorized and his authorization is not revoked until she notifies the bank.