The answer really depends on your EFT disclosures:
See the commentary to 1005.3(b)(1) - Definition of an Electronic Funds Transfer
vi. A payment made by a bill payer under a bill-payment service available to a consumer via computer or other electronic means, unless the terms of the bill-payment service explicitly state that all payments, or all payments to a particular payee or payees, will be solely by check, draft, or similar paper instrument drawn on the consumer's account, and the payee or payees that will be paid in this manner are identified to the consumer.
Whether or not Reg E applies if you paid an item that your customer did not authorized, it will at the very least be governed by your online banking terms and conditions and your deposit contract.
Your customer also has a valid Reg Z claim for the unauthorized advance from the HELOC so if you must follow the billing error resolution procedures in 1026.13.
Sola Gratia, Sola Fides, Sola Scriptura, Solus Christus, Soli Deo Gloria!www.tcaregs.com