Customer notifies us of unauthorized transactions on his account. Indicates he gave a guy he works with his personal card and authorized him to conducts certain work related purchases from so-so merchant. Customer now has over $6,000 in google charges on his card, that he didn't authorize, but these were done by the guy he works with (they all come through with work guy's name on them). Bank will have to take the loss on these google charges, correct?

See Comment 2(m)-2 under Comment for 1005.2 Definitions under the Official Interpretations.

2. Authority. If a consumer furnishes an access device and grants authority to make transfers to a person (such as a family member or co-worker) who exceeds the authority given, the consumer is fully liable for the transfers unless the consumer has notified the financial institution that transfers by that person are no longer authorized.

So we don't have to take the loss on these, since the customer never notified us that transfers by this person are no longer authorized?

Correct, The transfers do not meet the definition of "unauthorized" because the consumer granted authority to the coworker to use the access device and the coworker exceeded the authority given.

Looks like your customer has legal action against his pal to recover his money, DOCUMENT, DOCUMENT, DOCUMENT

Original Anon Here - so we are told by our core processor (who handles our card dispute investigations) that under Mastercard we can only submit 15 fraud items per card per dispute, so this customer has well beyond 15 items to dispute....so we won't have any investigation/documentation to support that anything beyond the 15 submitted for review, are in fact the co-workers. So do we have to take the loss on these, since we can't prove (with documentation) that the co-worker did these?

Why are you even submitting them, if they already told you that he had authorized a co-worker to use the card and they exceeded their authority?

Anon, re-read the first reply with the regulatory wording

Yes and you already stated "these were done by the guy he works with (they all come through with work guy's name on them).". What more proof do you need?

This is with regard to the 15 that were investigated....not the others beyond that. Can we assume they are all done by the co-worker, or must we have proof to deny the claim even though these aren't considered unauthorized?

I would not want to have a record that 15 were investigated and the rest were ignored. Your bank may choose to outsource its investigation function but it can't outsource the obligation for compliance. The core processor needs a better answer than "we can only submit 15 to MC." That is an issue that goes beyond this particular matter.

But Randy's point is on target. You already have evidence of who did the transactions. Check your records and review any other available information about the situation. Is there any evidence that some other party (not the co-worker) did the transactions? If not then you have evidence of who did them, and you have no contrary evidence, and based on your cardholder's statements the transactions were not "unauthorized" within the meaning of Reg. E.

But you can't say that you didn't conduct an investigation but still concluded the transactions were unauthorized. That is simply handing the regulator a baseball bat and saying "please hit me."

Regarding limits for chargebacks - information from our core provider states: "Mastercard only allows 15 fraud items per card per dispute." Does this sound correct to anyone else?

Your core provider is correct. Mastercard expects financial institutions to take some responsibility to limit fraud through monitoring programs so fraud chargebacks are limited to 15 per account.

Thanks Brian. Glad to hear that is correct information provided by our core provider.

So should we only handle these 15 as not being unauthorized (so customer is fully liable), since customer gave authority and it was exceeded by co-worker - based on our investigation of these 15? And then take a loss on the remaining transactions above 15, since we don't have supportive evidence that these too were conducted by the co-worker?

Are you using the correct return code? There is a limit for fraudulent processing of transactions, but that is not what appears to have happened here.

For proof, are you not just doing an information request? You are not trying to do a chargeback.

Brian,

Original anon here....what is your take on this?

So should we only handle these 15 as not being unauthorized (so customer is fully liable), since customer gave authority and it was exceeded by co-worker - based on our investigation of these 15? And then take a loss on the remaining transactions above 15, since we don't have supportive evidence that these too were conducted by the co-worker?

Not Brian, but I'll respond anyway:

"since we don't have supportive evidence that these too were conducted by the co-worker?" Is that statement really true? You have some evidence of what happened - there are many facts that bear on this situation: You know the cardholder gave the card to the co-worker. You know the co-worker did the 15 transactions you refer to. You have no evidence that anyone else has had possession of the card. So you certainly have some evidence of what happened. You might also want to consider times at which the transactions occurred (did they occur during the time period the co-worker seems to have had the card?), and the merchants/locations where the transactions were conducted (were they physically near locations at which you "know" the co-worker did transactions, or were they similar in nature?).

There are facts to be had. Whether they are conclusive or not, they may be sufficient to convince the bank that the transactions in question were all done by the same co-worker.

I agree with rainman here. You can take any information you have on patterns, etc., including what you have documented on the first 15 transactions, to form a conclusion that the other items were similarly completed by this "coworker."

And, to be blunt, I'd be considering terminating this customer's account.