The customer's liability is based on when they notify you of an error and there is no statute of limitations for a customer to make a claim. Reg E does not care whether you have recovery rights via NACHA or VISA/MC which have their own rules for returning items.
If your customer does not notify you timely of an error, the error resolution procedures in 1005.11 do not apply so you don't have to provide provisional credit or complete an investigation in 45 days, but look at the commentary which notes that 1005.6 still applies.
"7. Effect of late notice. An institution is not required to comply with the requirements of this section for any notice of error from the consumer that is received by the institution later than 60 days from the date on which the periodic statement first reflecting the error is sent. Where the consumer's assertion of error involves an unauthorized EFT, however, the institution must comply with § 1005.6 before it may impose any liability on the consumer."
This means that you can take your time to determine if an error occurred. Although you cannot process a late return, you could contact the ODFI so see if you can obtain information about the initial authorization to see if there was an error or attempt to contact the merchant directly if you have adequate information to know the source of the debit. If you don't gather enough information to make a determination or you conclude that transactions are unauthorized, 1005.6(b)(3) requires that you reimburse the customer for unauthorized transactions that occur between the date of the first unauthorized transaction and 60 days after you transmitted the statement on which that first transaction appeared.
_________________________
Sola Gratia, Sola Fides, Sola Scriptura, Solus Christus, Soli Deo Gloria!
www.tcaregs.com