Perhaps the vendor was mirroring the Uniform Commercial Code timeframes for reporting forgeries which in most states is one year. However, even that timeframe can be modified by deposit agreement.
If you research previous threads and Guru Q & A's on this topic, you will find responses from me which reference a page on VISA's website which states that businesses do have 60 days to report an unauthorized charge to qualify for Zero Liability according to VISA Operating Rules. It's been a few years, but VISA removed this specific timeframe and now has a generic statement advising cardholders to contact their issuing bank for terms and limitations of Zero Liability. In other words, you now have much more flexibility in customizing your program.
_________________________
Sola Gratia, Sola Fides, Sola Scriptura, Solus Christus, Soli Deo Gloria!
www.tcaregs.com