We have a customer who has disputed 5 debit card charges on the same day. All were originated by the same merchant in Sweeden. We submited a dispute with our card processor. They have responded and said that since the transactions were completed utilizing MasterCard's UCAF (Universal Cardholder Authentication Field), they are denying the dispute. We have no other information to prove the customer did or didn't authorize the transactions. Is this UCAF reason enough for us to deny the claim and refuse to refund the customers money?

Unfortunately, it is not. The transactions were done with the extra authentication provded through MasterCard SecureCode which protects the merchant from the chargeback. However, MasterCard's Zero Liability and Reg E protections for fraud still apply.
Your customer's MasterCard Securecode password, or the identifying information needed to create one still can be phished, hacked, obtained through dumpster diving, etc.

Although you do not have chargeback rights for "No Customer Authorization" the merchant is still required to respond to a Retreival Request. At least you can obtain what goods/services were purchased and make a determination whether or not your customer actually benefited from them. If you get REALLY lucky and the merchant fails to respond to the request, chargeback right 4801 Requested Transaction Data not Received opens up for you to recover the funds from the transactions.


I will be covering this topic and other debit card related issues on a webinr on September 23rd.

Debit Cards - Error Resolution Problems Solved

We have the same problem with verified by VISA -- that "security" feature is such a sham and a ripoff.

Good information. I just can't seem to convince management that sometimes there's no "out" for the bank in these disputes.

Actually the majority of the time there is no 'out'. My feeling is Reg E is the most bank unfriendly regulation out there.

Am I correct in that the bank can try to use the card processor's dispute/chargeback process to resolve a Reg E claim, but that if it doesn't result in any meaningful information (such as in this case with MasterCard SecureCode), the Bank is still required to take other steps to investigate? The ultimate responsibility is for the bank to investigate and come to a conclusion on whether the transaction was authorized. The chargeback process is more of a way for the bank to collect in hopes of defraying the cost of paying claims - correct?

That's a pretty good summary, AK.

Reg E is not fair. I've never heard anyone say it is. And V/MC are just as interested in transaction volume as the bank. In the long run, you want to make more than you lose. But there are claims on which you will lose.

Reg E favors the consumer. It always has and so long as banks are making money, it always will. In fact, the law even tells us the burden is on the bank.

15 U.S.C. Sec. 1693g, Consumer liability
(b) Burden of proof
In any action which involves a consumer's liability for an unauthorized electronic fund transfer, the burden of proof is upon the financial institution to show that the electronic fund transfer was authorized or, if the electronic fund transfer was unauthorized, then the burden of proof is upon the financial institution to establish that the conditions of liability

As a shameless plug, this is the kind of question Brian and I will be covering in our upcoming webinar. It recaps Reg E requirements, and focuses on debit card rules like this. http://calendar.bollearningconnect.com/main.php?view=event&eventid=1281723524271

I've submitted my request to management for approval to participate in this BOL webinar. Thanks for the tip!