We have a cardholder who has recurring debit card transactions coming out of her account monthly since November 2020. She is just now claiming fraud. The first statement date in which the transaction appears is mid-December. Therefore she is past the 60 day timeframe. Please advise if I am thinking this correctly. We must research the November, December, and January transactions since those fall within the 60 days of the first statement. Cardholder is responsible for the February and March transactions since those could have been prevented by closing the card had we known about it. Since she did not report these transactions "in a timely manner" as in within that 60 day timeframe, can she be held liable for anything?

She can be held liable for 100% of the transactions that occurred after the 60 day period (after the first statement). Plus, her liability for the period before the statement is sent, and up to 60 days following will be subject to either $50 of liability or $500 of liability, depending on when she learned of the fraud.

From the commentary:
"The consumer's liability for unauthorized transfers before the statement is sent, and up to 60 days following, is determined based on the first two tiers of liability: up to $50 if the consumer notifies the financial institution within two business days of learning of the loss or theft of the card and up to $500 if the consumer notifies the institution after two business days of learning of the loss or theft."

When did the customer learn of the loss/theft?

Good question, Adam. There's no indicating in the OP that the card was lost or stolen. And if it was not lost or stolen, the first two "tiers" of section 1005.6(b) consumer liability don't kick in at all.

So what we need to know is how the transactions came in. Did they appear to be debit card transactions or ACH transactions. If debit card transactions, how did the malign actor obtain the card information? Inquiring minds want .......

Good points, John. The way I read it, the OP did imply that the transactions in question were "recurring debit card transactions" and that the customer is "now claiming fraud." As the commentary to the definition of "unauthorized electronic fund transfer" includes "a transfer initiated by a person who obtained the access device from the consumer through fraud or robbery", my answer assumed the $50 and $500 tiers of liability applied.

But I agree that we need clarification to give a complete answer, which is why I posed the question.

Hello, sorry for the delay in response. These are debit card transactions and the cardholder has the physical card in her possession. When the merchant ran the transaction in March, it popped up a fraud alert so we contacted her to verify the activity. That is when she claimed fraud. After noticing that she's had this same charge coming out the last several months, we questioned her on those as well. She claims those are fraud also. Cardholder liability is pretty clear when there is a lost/stolen debit card involved. However, it gets confusing when there is not a physical card involved! Any clarification would be appreciated!!

If a device was not stolen, she would be responsible for all items after 60 days from the date of the statement that showed the first fraudulent transaction.

Are we able to hold her responsible for anything in that beginning timeframe (prior to 60 days from first statement) since she did not report the transactions for several months?

No.

(3) Periodic statement; timely notice not given. A consumer must report an unauthorized electronic fund transfer that appears on a periodic statement within 60 days of the financial institution's transmittal of the statement to avoid liability for subsequent transfers. If the consumer fails to do so, the consumer's liability shall not exceed the amount of the unauthorized transfers that occur after the close of the 60 days and before notice to the institution, and that the institution establishes would not have occurred had the consumer notified the institution within the 60-day period.

Ok, thank you … that is what I originally thought but I wanted to verify to confirm I was thinking it through correctly. Thank you everyone for your responses. I wish they would revise these rules to make them a little easier to understand and to make the cardholder a little more responsible when it comes to reporting. Thank you again for clarifying!

Every banker's dream - but I wouldn't be holding my breath!

Reviving this thread for another question. Member opened account with us in January of 2023. On March 19th, she noticed two Apple transactions, one flagged as recurring, post to her account but she was busy and needed the card active, so she didn't report the transactions to us until May 1st. There were two other transactions that posted that same day, and both have the recurring flag, but she did not notice these. We questioned her on the two other transactions, and she said one shows up on her Apple account, but not the other and she wanted to add the other transaction to the dispute.

Since she knew of the transactions 2 weeks before she reported it to us, can we use the tiered liability? These were card not present transactions.

1005.6(b) says that it can be applied to "a single transaction or a series of related transactions."

Only you can determine based on your investigation of these transactions if they constitute a "series of transactions" for the purpose of consumer liability. You will also have to determine if the cardholder met any requirements for safeguarding their card and prompt notification of error under your cardholder agreement to qualify for Visa/Mastercard Zero Liability as that would supersede liability limits under Reg E.