The cardholder is not only covered by Reg E, but also MasterCard's Zero Liability protection so the cardholder will not have any liability if the charges are unauthorized. The answer to whether you or the merchant is liabile is, it depends.
1. If the cardholder's card was stolen at the time of the disputed charges AND the cardholder's letter clearly states when the card was stolen vs. when the transaction occured, you can will a chargeback for a pay-at-the pump purchase. Use chargeback code 4837 No cardholder authorization.
2. If the cardholder is still in possession of their card and it was counterfeited, the liability for the charges is on the bank. MasterCard provides chargeback protection for counterfeit cards at unattended terminals.
From the MasterCard chargeback guide:
Non-Counterfeit CAT 2. The issuer can use message reason code 4837 for non-counterfeit transactions occurring at a cardholder-activated terminal (CAT) that was properly identified as a CAT Level 2 in the authorization messages and clearing records.
• Before processing the chargeback, the issuer must block the account on its host and list the cardholder account number on the MasterCard Account File with a “capture card” response until card expiration.
• The cardholder letter alleging that the transaction is fraudulent also must state, or the issuer must otherwise certify by means of a separate document accompanying the cardholder letter, that the card was lost or stolen at the time of the transaction. A letter that indicates that the transaction resulted from Never Received Issue (NRI) fraud is considered
to be lost or stolen if the letter or additional documentation accompanying the chargeback substantiates that the NRI card was the card used for the disputed transaction.
_________________________
Sola Gratia, Sola Fides, Sola Scriptura, Solus Christus, Soli Deo Gloria!
www.tcaregs.com