I've done it again, I've second guessed myself into a corner.

Can someone help me separate in my mind how these two issues work together?

The customer is limited to $50 liability if he reports loss or theft of card within 2 days; $500 if more than two days.

But the customer also has 60 days from the date of the statement and we have to refund all unauthorized EFTs for the statement in question and 60 days after.

So which is it? Do we refund all within 60 days or do we hold back $50 or $500 form the refunds?

Hold back $50-$500 if they notified you timely. If they did not notify you timely, they're liable for everything after the 60 days in addition to the $50-$500.

And, if the transaction didn't involve an access device, or if the customer did not know of the loss or theft of the access device used, the $50/$500 rules don't apply, and the customer is only liable for transactions after the end of the 60-day period.