I received this from one of our offices:

I am doing research for my Cards department. We have a customer that is claiming fraud activity on about $3000.00 in debit card purchases from March 23 to April 9.

The customer was notified via text banking on 3.23.20 that a suspicious transaction was taking place (listed the transaction), customer replied YES this was o.k. Transactions continued to come thru the account.

On 3.31.20 customer was notified via text banking that another suspicious transaction was taking place, customer replied YES this was o.k. Transactions continued to come thru the account.

On 4.9.20 customer was notified via text banking that yet another suspicious transaction was taking place, customer replied YES this was o.k. Transactions continued to come thru the account.

Later on 4.9.20 customer called the bank and claims that all the transactions were fraudulent. Card services have been trying to reach the customer to obtain more details, but unable to reach them (This customer has also logged into online banking multiple times during this disputed time frame)

Our question is due to the customer lack of notifying the credit union, what is our liability with these claims?

Interesting. I'm going to play devil's advocate. Are you sure the customer replied "yes" to these? Could someone else have done it? Maybe someone (like a family member or friend) had their phone and replied "yes". Maybe they didn't fully understand the text and replied yes in error.

Does replying "yes" mean that the customer has truly authorized the transaction or they can't later dispute the transaction? I don't think there's anything in Reg E that says "if you get a confirmation by text, the consumer can't later dispute the transaction." I think the text verification is awesome, but it doesn't take the consumers rights away from them.

With that said, if the customer won't cooperate in your investigation, that makes it hard (I feel for you), but I don't think you can say these were authorized for sure. Honestly, I would call the costumer (leave them a voice message) saying "we need more info from you and if we can't get it, we're going to deny your claim." Technically, you may not be able to do that under Reg E, but I would hope this would "scare" them into action.

Thank you, David!

I have a similar situation. Our fraud vendor flagged a number of transactions for review back in February. The personal banker called the customer directly, and the customer identified charges that were fraudulent, and those that were not. The card was closed and a new one ordered. (No ABU applied). Another case just generated, and now the customer claims the recurring charges from the merchant previously verified as legitimate, are now fraudulent.
It's clear that the charges started again once the new card was activated by the cardholder.
Do we have to go back now to those original transactions in February to start our investigation from that point forward? What recourse or liability do we have?