Would it be permissible to shift liability to the consumer under 1005.6 (3) Transfers not involving access device, if the bank receives a late notice regarding a single unauthorized ACH transaction and the reasonable investigation concludes that the transaction was invalid?

Welcome to BOL.

If it is a one time transaction, no. That would only apply to recurring transactions after 60 days from the statement date of the first transaction.

Thanks.