Good Morning - We have a client disputing multiple CashApp purchases where they are stating they have never used Cash App or the Merchant who received the money. I noticed a lot of recent P2P dialogue stating that some of these P2P providers are considered the financial institution and that a dispute should go through them. Is this an instance where we would state the client would need to file the dispute with Cash App directly or is there a part of this our bank should be handling? Thank you!

The CFPB Reg E FAQS from December 2021 say the exact opposite of this statement.

See Financial Institution FAQ #4. The CFPB says that while Cash App is a financial institution, the depository financial institution (you) is still considered a financial institution for the purpose of the definition since the charge debited an account at your institution.

Also see Unauthorized EFT FAQ #11. It specifically states you have an obligation to investigate when a non-bank P2P provider initiates a debit to your customer's account.

Anytime we try and report fraud to Visa about unauthorized Cash App transaction, they respond that there are no chargeback rights. For Cash App, I believe you have to authenticate the access and physically add your card information. Would this mean that if the client states their P2P Cash App transfer is unauthorized then we would automatically be taking a bank loss?

I also just called Cash App support where they let me know if a transaction is considered unauthorized that the dispute would be handled with them directly. Is this something that we can take Cash Apps word on?

Reg E doesn't care about your ability to recover funds via the chargeback process. Reg E says that as the depository financial institution holding a consumer's account, you are required to reimburse them according to 1005.6(b). As a non-bank financial institution, Cash App also has an obligation to investigate, but that does not eliminate the investigation requirements for you as noted by the CFPB FAQ cited above.

We have not ever had an issue with disputing a Cash App when we report it as fraud. We have recovered funds from Cash App or Cash App has sent us "proof" that the transaction was done by our member.

Which now leads to a very confusing question brought up by the recent FAQs from the CFPB. If a member comes in and states that a Cash App transaction is fraudulent and we dispute it and get information back from Cash App that it was the member's Cash App account that was used, are we allowed to revoke the provisional credit? If the Cash App account was hacked, it was fraud even though it will show that a Cash App account established by our member was used with the logon and passcode known only to our member. I have revoked credit in these circumstances in the past thinking the member still had the ability to dispute it with Cash App since their Cash App account was used. But now, given the liability has fully shifted to the FI according to the CFPB, do I need to rely only on the word of the member and not any evidence the merchant may provide? If that is the case,

The fact that the ID and password was used is no more proof than a PIN being used for an ATM withdrawal. This information can be hacked, phished, etc. You should consider other information that Cash App may provide. For example, was a customer thumb print used? That's a little harder to hack. Was the IP geography similar to where you customer usually made Cash App transfers?

Generally, ID and password alone are not enough to conclude that your customer initiated the transfer and the CFPB FAQs make it quite clear that the depository financial institution is responsible.

Thank you Brian. I suspected that was the case.

On the information I have received back from Cash App, I haven't ever seen the method of logging in disclosed. They have provided IP addresses though. IP may or may not be helpful since we see a lot of "errors" committed by family and friends.

I have a customer who has used Cashapp for years and then claims the last couple transactions weren't his. When we asked whether he reached out to Cashapp he says they won't help him since his account was restricted.

He also won't provide us with his mailling address so we can send him a letter on the Reg E.

He also quotes Reg E Rules TO A T.
I'm like 1000% certain he's trying to defraud us but obviously can't prove it.

It's been a while since I dealt with Reg E as I was in a different part of operations and I need to seriously brush up.
So, there are so many conflicting sources regarding how the bank handles disputes when it comes to EFT service providers such as Cashapp.

Let me give you a quick update on my case.
- Customer reported 2/8/22. about 1500 in cash app transactions. He's already done hundreds of dollars in the last year consistently.
- When I asked him when he became aware of the "unauthorized" transactions he says it was that same day. I asked him if he's the only one with his online banking credentials and if he's shared his codes with anyone. He says no. I inform him that we have daily login information and IP address information and they show daily login so if he's looking at his account everyday then why didn't he inform us sooner? He then claims that he's got multiple devices and maybe someone stole one of them.
- I ask him where's he's located now because we have return mail on his account and he says he's not at liberty to say. ???
Anyway so I'm looking at all sorts of resources including some here on BOL and am so confused as to who needs to handle the dispute.
Is it Cashapp? https://cash.app/legal/us/en-us/tos - since they are the EFT Provider and they gave him an access device (ID & Password)

We still submitted the disputes but of course we're not going to get credit. BUT we've missed the provisional credit deadline and he's quoting Reg E stating if we needed the 45 days to complete the investigation that we should have extended provisional credit. It's obvious he's going to take the money and run. Nevertheless I became aware of the whole situation on Friday 2/25 and It's been driving me crazy trying to catch up with the Reg.


So if a customer uses cashapp all the time and then disp

can you validate that you are actually speaking to your customer and not someone claiming to be the customer?