Our bank debit cards were recently affected from what we assume was the Heartland Security breach. About 100 cards were compromised.

We immediately granted (provisional) credit back to the customers as we knew it was a fraud issue. That was about 30 days ago.

We now are getting representments from the merchants saying that the transactions are legitimate and they have signatures for proof.

We know, however, given all of the out of state activity, that the transactions are not legitimate and even the presence of some forged signature does not prove that our customer did the transaction.

The provisional credit has been given, and making the customer responsible for these chargebacks and representments doesn;t seem fair.

Does the bank have to chalk this up as a loss? How are other people dealing with this issue?

Any feedback would be greatly appreciated.

Issuing banks get the interchange fee income so they bear the cost of signature type card fraud. As long as the transaction was authorized properly, neither the merchant or real customer bear any liability regarding fraud. Liability rules are somewhat different for mail/telephone/internet type merchants.

If you know these transactions were fraudulent, you won't be able to hold your consumer responsible. That leaves you or the merchant. I am not the guru in those chargeback issues but I believe the bank loses more than it wins based on lose rules for the merchant.

Sorry, but the short story is that just like Reg E is written to protect consumers, Visa Rules are written to protect Merchants - - as an enticement to get them to accept the card as a form of payment even though they only get $98 out of a $100 sale for instance.

IF - The merchant processed the transaction as "Card Present" and has a signed receipt they are golden, or if they processed it with a PIN.