So we have a new prepaid cardholder who filed a dispute of a non-dispense from an ATM. In less than 24 hours the cardholder filed a second atm non-dispense dispute. We feel it is very unlikely that there are two atm non-dispenses in less than 24 hours. We did issue a PC for the first dispute but when the second one came up we began to look at it as potential fraud.

We are waiting for Visa to come back with documentation supporting a decision that this is fraudulent (We are still within 45 days). Is there anything else we need to do or consider?

Reg E has no provision for withholding provisional credit. If the first deposit to this prepaid account was made less than 30 days ago, the only relief Reg E affords you is that your provisional credit is not required until the 20th business day after the customer notified you of the error. Since you suspect these may be fraudulent claims, I would take advantage of this extra time before providing provisional credit on the second claim.

Brian we’ve determined that the transactions are fraudulent and have locked the cards and plan to terminate the relationship. What we are struggling with is how to avoid the losses if we provided the PC? If the PCs were provided we feel very strongly we would be out the money (And may be out the funds in the first example).

Is there really no way to avoid this?

I went back and reread your original question. The answer to your provisional credit question hinges on whether this is a general purpose reloadable card or a government benefit/payroll card.

1005.11(c)(2) Forty-five day period. If the financial institution is unable to complete its investigation within 10 business days, the institution may take up to 45 days from receipt of a notice of error to investigate and determine whether an error occurred, provided the institution does the following:

(i) Provisionally credits the consumer's account in the amount of the alleged error (including interest where applicable) within 10 business days of receiving the error notice. If the financial institution has a reasonable basis for believing that an unauthorized electronic fund transfer has occurred and the institution has satisfied the requirements of § 1005.6(a), the institution may withhold a maximum of $50 from the amount credited. An institution need not provisionally credit the consumer's account if:

(A) The institution requires but does not receive written confirmation within 10 business days of an oral notice of error; or

(B) The alleged error involves an account that is subject to Regulation T of the Board of Governors of the Federal Reserve System (Securities Credit by Brokers and Dealers, 12 CFR part 220); or,

(C) The alleged error involves a prepaid account, other than a payroll card account or government benefit account, for which the financial institution has not completed its consumer identification and verification process, as set forth in § 1005.18(e)(3)(ii).

Brian - I looked over your response and I have an additional question. Would (c) be applicable to a cardholder who was onboarded successfully? I'm trying to understand what "Consumer identification and verification" means? Would this tie into our CIP Program? For example this individual was onboarded but once we observed the activity we questioned the veracity of the information provided.

Thanks again.

(ii) For purposes of paragraph (e)(3)(i) of this section, a financial institution has not successfully completed its consumer identification and verification process where:

(A) The financial institution has not concluded its consumer identification and verification process with respect to a particular prepaid account, provided that it has disclosed to the consumer the risks of not registering and verifying the account using a notice that is substantially similar to the model notice contained in paragraph (c) of appendix A-7 of this part.

(B) The financial institution has concluded its consumer identification and verification process with respect to a particular prepaid account, but could not verify the identity of the consumer, provided that it has disclosed to the consumer the risks of not registering and verifying the account using a notice that is substantially similar to the model notice contained in paragraph (c) of appendix A-7 of this part; or

(C) The financial institution does not have a consumer identification and verification process for the prepaid account program, provided that it has made the alternative disclosure described in paragraph (d)(1)(ii) of this section and complies with the process it has disclosed.

Thank you for posting this Randy. I'm still not sure that I understand. For our prepaid cards, a consumer applies for a card online and if the individual passes non-documentary ID verification, sanctions screening, and some other screening checks, a card is issued (The consumer must agree to our TOS and appropriate disclosures are provided).

The consumer then needs to register and activate the card. If there are no issues, the card can then be used. In the case I'm inquiring about, the individual generally followed the previous process. We questioned whether the individual was who he said he was after the first PC was provided and he made a similar dispute.

Looking at what you posted, would this line up with (B)?

It sounds like you complete identification and verification processes prior to issuing a card. Unless you have documented evidence to prove ID theft, having suspicions is not adequate to refuse provisional credit. If you are sustaining losses due to fraudulent applications and disputes, then you should be evaluating your onboarding process, not your Reg E process.

Unfortunately there isn't much we can do for our prepaid onboarding which is separate from a banking area. All cardholder identity verification is done via non-documentary methods and if their information validates a card will be issued.

Separate question. If believe the activity to be suspicious, based on the timing of both disputes, would that be sufficient to delay/deny the second PC?

There is no suspected fraud exception in Regulation E.

Maybe someone needs to review the original business plan that was approved before launching this product and the projected income. I bet they missed terribly on projecting this sort of risk. It might need to be revisited and updated and resubmitted to determine continuing with this product.

Of course, if your marketing department is anything like the ones I used to work with, you might get the deer in the highlights stare when you mention a business plan.

It's funny you mention that Randy as there was a business plan completed but those employees who did it are no longer with us. Unfortunately some of us have been roped in to determine the viability of this BU. It's challenging enough, but contracts were signed based on the business plan which probably didn't account for certain operational and risk management issues as it relates to prepaid cards.

I spoke with our Ops guys in the bank and they indicated that there are individuals who know Reg. E and game the system and they are taking losses on this type of activity as well. Is there really nothing a FI can do? For our example, he hit two (2) different ATMs a block apart and filed the disputes within 30 minutes of each other. Are we really on the hook for this?

I'm not doubting you or Brian, but I'm trying to understand this better.

Thanks again for your help.

Not according to Reg E. The bad guys know the Regs as well or better than us. This is why counterfeit cashier's check fraud is often performed in amounts less than $5,525.

You have identified the financial/operational risks of offering a product where you verify the identify of your customer through non-documentary means. This should be considered in the cost/benefit analysis of offering the product.

My more sarcastic response is to quote the movie "The Hunt For Red October."

Adm. Painter : What's his plan?
Jack Ryan : His plan?
Adm. Painter : Russians don't take a dump, son, without a plan.

In a way this is a risk the bank accepts if it chooses not to mitigate it. For the benefit of the consumer's protection, the Reg doesn't give the bank that much judgmental discretion.

How long does it take to verify the dispense error with the owner/operator of an ATM these days?

My understanding is that the ATM Operator will not cooperate with our request to verify the dispense error Andy.

That may be a violation of the procedures of the ATM network that handled the transaction. That raises the question of how much hassle and expense it will take to get the network to force the issue with the ATM Operator.

If this is common with (stoopid) ATM owner/operators who don't realize they're hurting themselves, they need to be discussed with network admins and the bad actors need to be removed somehow.