Customer filed a dispute for an online order of a supplemental aid that promotes physical wellness. Merchant provided her name, address, card number, email address, phone number, and validated her cvv when she made the transaction along with the IP address that she made the order from, which is the same ip she uses for online banking. Card was in her possession. She's INSISTING she did not make this purchase and threatening legal action. I think we were ok to take back the pro credit, but would like your feedback.

People threaten legal action all the time when they don't get their way. Is it possible that a member of her household initiated the charge without her knowledge or consent? Sure it's possible, but Reg E is not a court of law and does not require proof beyond a reasonable doubt. If you conclude based on this information that the charge is authorized, then deny the claim. You may also want to consider whether or not you provide another debit card lest you find yourself in the same situation again with this customer.

Along similar lines, if we suspect that the customer participated in the transaction and is trying to commit fraud on the bank, are we still required to give provisional credit within 10 days?

If you can resolve the claim by confirming your suspicions prior to the 10th business day, then no provisional credit is required because you deny the claim. However, if your investigation is ongoing, there are no provisions in Reg E for withholding provisional credit other than if the customer fails to provide written confirmation or at most withholding $50 in the event the claim involves an unauthorized EFT using an access device.