We have a customer dispute for unauthorized charges, and I am unsure how to exactly apply the Reg E liability tiers.

Customer says card was stolen at the beginning of July (but that the card later "reappeared" and the customer continued using it). Dispute and police report were filed over a month later in mid-August. While I suspect that a family member was involved, I am not sure that we can prove this.

Customer is disputing ATM withdrawals (not our ATMs) from June (before the card was stolen), July, and August. How should we treat the transactions the customer is disputing before the date the card went missing? I know liability hinges on when the customer discovered the card was missing, but I am still not quite sure how to handle this one.

Thanks.

The answer hinges on whether the ATM withdrawals from June were the result of your customer's physical card being stolen and the later returned or the card being counterfeited.

A counterfeit card is not an accepted access device that triggers the $50/$500 liability tiers in 1005.6 so the customers liability would be for any transactions that occurred more than 60 days from the delivery of the June statement on which the first unauthorized charge appears. Depending on when that June statement cut the customer could be liable for only the most recent transactions here in August or perhaps none of the transactions if the June statement didn't cut until June 20-30.

Since we suspect "friendly fraud" it is likely that the card was stolen and then returned so the cardholder did not recognize the theft until July. Since liability is based on the consumer learning of the theft, the cardholder could be liable for $50.00 of the transactions from June until 2 business days after the date in July when the theft was discovered. If there are additional transactions after the 2 business days in July-August, the customer can be held for an additional $450.00 in liability for these transactions up to a total of $500.00. As with the counterfeit situation, the unlimited liability tier will only come into play if that June statement with unauthorized charges cut early enough in the month and there are transactions after that 60 day timeframe in August.

To put this in a table for you and plugging in sample dates. I am going to say that the first charge was June 8th, the statement cut on June 15th and the card was discovered lost on July 6th.

$50.00 - June 8th - July 8th
Up to $500.00 - July 9th - August 14th
Unlimited - August 15th - present

Remember the tiers only apply to transactions that occurred during the date ranges. Just because we waited longer than 60 days from the statement date does not mean the liability is unlimited for all transactions.

Isnt the customer implying that back in early July they knew the card was stolen (or at the least, lost)? Doesn't that change the liability for subsequent transactions starting in July since they did not inform the bank within two days of learning of the loss or theft of the card? When is the customer saying the card "re-appeared"? Baed on what was in the original post I am thinking it reappeared sometime in August.

Ok, so I adjusted my posts to reflect that the OP said the "beginning of July." Regardless, it does not increase the subsequent liability beyond $500.00 until we get to 60 days from the delivery of the June statement. Since the OP does not provide exact dates, I provided an estimated scenario using fictitious dates to show how the math works.

This is very helpful- thank you!

Please allow me to run the following scenario and my opinions to see if they are Reg E compliant.
Customer notifies bank of unauthorized transactions on 8/27. (He gave his card to his roommate to use and received the card back from her a couple of hours later and noticed that she transacted more than he authorized. She was told to take $100 and she ended up transacting another time for $200 more)
He comes into the bank and looks at his account stmt. Turns out there are quite a few transactions conducted online that he didn't know about on 8/6 until present.

My thought is that we are to give him the provisional credit less the $50 for all of the transactions up until the 27th. Would this be correct? He did give her the card and the PIN but consumer negligence does not limit the protections afforded by Reg E.

Am I on the right track with this?

If you review the definition of "unauthorized electronic funds transfer in §1005.2(m), you'll see:
The term does not include an electronic fund transfer initiated:
By a person who was furnished the access device to the consumer’s account by the consumer, unless the consumer has notified the financial institution that transfers by that person are no longer authorized;

When the customer gave his card to his roommate, he authorized everything that roommate did. That's not negligence, it's defined as authorization in Reg E.

The other transactions he noticed when he came to the bank could be unauthorized, but we don't know enough to say for sure. Find out if he had given her authorization for those or if he has knowledge of how those transactions may have occurred. He's also breaking your card holder agreement by allowing others to use his card. You may want to consider not allowing him to have a card.

He is asserting that he has been "played the entire time" by this roommate. We will get further details as to the timeline of when he may have first given access to the debit card to her, but if she gave it back, which it appeared she did as he continued to use it and he notices now that those online transactions are out there that he didn't do, they would be considered unauthorized correct?

Although he secured the physical access device, the regulation defines an access device as a "card, code or other means to access the account." The other disputed transactions were performed online which could mean that he gave her the card, she wrote the number down and gave the card back to him and then used the card number to make the online purchases. If he furnished the card number to her prior to 8/6, you may use the citation that David provided to deny the claim.

Ahhh. So if we can establish a timeline where he grants access on 8/6 we can deny the claim. Are there any MasterCard $0 liability rules that would come in to play though?