If we're sending text messages to customers to confirm debit card transactions are/are not fraudulent, do we need consumer consent under TCPA to send these texts? Can someone point me to a source that would clarify this? Thanks.

I believe you would need consent for text messages assuming this is an automated system. Text messages would fall under the cellular telephone service noted below and therefore you cannot send automated messages.

64.1200 Delivery restrictions.
(a) No person or entity may:

(1) Except as provided in paragraph (a)(2) of this section, initiate any telephone call (other than a call made for emergency purposes or is made with the prior express consent of the called party) using an automatic telephone dialing system or an artificial or prerecorded voice;

(i) To any emergency telephone line, including any 911 line and any emergency line of a hospital, medical physician or service office, health care facility, poison control center, or fire protection or law enforcement agency;

(ii) To the telephone line of any guest room or patient room of a hospital, health care facility, elderly home, or similar establishment; or

(iii) To any telephone number assigned to a paging service, cellular telephone service, specialized mobile radio service, or other radio common carrier service, or any service for which the called party is charged for the call.

(iv) A person will not be liable for violating the prohibition in paragraph (a)(1)(iii) of this section when the call is placed to a wireless number that has been ported from wireline service and such call is a voice call; not knowingly made to a wireless number; and made within 15 days of the porting of the number from wireline to wireless service, provided the number is not already on the national do-not-call registry or caller's company-specific do-not-call list.

Read this thread: https://www.bankersonline.com/forum/ubbthreads.php/topics/2223670/tcpa