I have a customer that claims that several withdrawals on here statement are not hers. These withdrawals were of course done at ATM's without cameras. She claims that a friend watched her put in her pin number at an ATM and then her friend took the card and made a few withdrawals. Her friend later gave the card back to her saying that she had found it under the seat in her car. She did not notify us until about two weeks after the transactions had already hit the account that they were not hers. I asked her to obtain a police report naming her friend and stating the accusation. She told me that she could have this, but has yet to give the information requested.

I am currently within the required timeline, but time is running out. Are we required to refund her money or can we claim that she was negligent with her pin number and card?

Sorry, but Regulation E is most forgiving of consumers' lax security when it comes to access devices and PINs. A customer's negligence or lack of care won't give you an excuse to avoid compliance with §205.11.

1. You cannot require that the police report be filed as a prerequisite to your completing your investigation.
2. If you told her that she needed to file her claim with you in writing and she failed to do so in ten days, you can avoid having to give her provisional credit.
3. Once you confirmed that you could not get photos at the ATMs in question, you pretty much closed your investigation, for all practical purposes, because you cannot prove that your customer authorized the transactions.
4. Now that you've concluded the investigation, you should credit the customer for the unauthorized transactions.
5. Based on your customer's story, you can now try to recover your money from her friend using whatever legal means you have. If that means filing a complaint with the police, you can do so.
6. You can ask your customer to cooperate with the police investigation, but you can't force her to.

If the customer had told you that she gave the card and PIN to her friend and authorized her to do one transaction, you would have a much better position. In that case, the regulation says any transaction made by the friend before your customer notifies you the friend is no longer allowed to use the card would not be an unauthorized EFT.

John is right on the mark. Basically, if you can't prove your customer did it, authorized it or received benefit, the claim will need to be paid.

Depending on how good a "friend" it is, emphasize your intentions (assuming it is so) to file a PD complaint and to prosecute to the fullest extent possible.

I'd also hold the customer's $50 liability back and cancel her use of a card since she was not careful with it in the first place.

Is there any thing in Reg E that would prevent a Bank in this situation from also closing the account?

Your deposit agreement should allow you to close for whatever reason. Reg. E doesn't address it.

Do banks usually purchase extra insurance to assist with the potential loss in this area? It appears that this is a growing area for risk in my bank and I wonder if I should be recommending additional insurance.

Thanks for your response

Requests and opinions are mine not my employer.

A risk, absolutely! But I haven't heard of any insurance for this. In insurance numbers, you'd be nickle and dimeing them because most claims will be smaller than a normal deductible.

Ok so then what areas for insurance am I suppose to be identifying. In my risk policy (I did not compile the policy) it identifies me as evaluating our insurance coverage for sufficiency. I realize Internet banking will be a "higher" risk and management and/or the board should re-evaluate our insurance coverage pertaining to this service. But what other areas should I be reviewing and how do I know if it is sufficient?

Thanks, buddy!!

Requests and opinions are mine not my employer.

Your insurance agent can tell you what types of insurance products are available and you can determine if the premiums are worth it, and which risks they mitigate.

Some losses are a common cost of doing business and won't be insurable. At least at a reasonable cost to you. This would be one, loan losses, etc.