the package included email correspondence with the merchant where the customer states that they did authorize the transacations.
I'm going to play devil's advocate with this one. It is also possible that the customer tried to obtain a refund from the merchant prior to filing a complaint with the bank and the merchant refused to work with them.
The account type this customer has requires ebanking and e-statements and we have the log where they logged into their ebanking account multiple times on each of the days they are claiming unauthorized transactions occured. So we beleive the customer had knowledge of the transactions prior and could have prevented any additional "unauthorized" transactions.
The Reg E liability in Section 1005.6 cannot be modified due to customer negligence and is based on when the customer learned of a theft of an access device. While you have logs proving the customer signed into the account, you do not have proof that they saw and identified the unauthorized charges as such. The customer could argue that they skimmed the account information just to check a balance or pay a bill and did not look carefully at the transaction history. Also if these transactions were done using a VISA/MasterCard debit card, your customer may be protected by Zero Liability making 1005.6 a moot point.
Do we have to give provisional credit?
Yes if you cannot complete your investigation in 10 business days (5 business days on a VISA debit card)
Some suggestions for your investigation:
1. Does the customer have any transactions from these merchants that are not being disputed? I often see small "free trial" purchases of 1.95-5.95 turn into $75-$99 disputed transactions when the customer failed to read what terms to which they were agreeing.
2. Did the merchant respond to the customer emails? If so, do these responsed provide any clues regarding the nature of the transactions?
3. If debit card charges and you can't prove the charges are valid through research, you may need to file chargebacks to get the merchant's side of the story. If ACH debits, as long as you are in your timeframes, return the transactions and be done.