With respect to 1005.6(b), since her dispute involves a single transaction, her liability is limited to $50 (if an access device was involved) or $0 of Mastercard/Visa Zero Liability applies. The $500 tier of 1005.6(b)(2) only applies to transactions that occur more than two business days after the customer learned of the loss/theft of the access device.
Whether the customer told you about the charge the day after it happened or told you two weeks after they saw it, there are no transactions that would fall into the $500 bucket. Reg E does not allow you to retroactively apply 1005.6(b)(2) or (b)(3) to earlier transactions.
Also, the fact that she signed into online banking may be considered in calculating liability but is not proof that she saw the transaction(s). Maybe she was looking for a specific check that cleared or a direct deposit and didn't really look at the balance. This is spelled out in the commentary to 1005.6(b).
"2. Knowledge of loss or theft of access device. The fact that a consumer has received a periodic statement that reflects unauthorized transfers may be a factor in determining whether the consumer had knowledge of the loss or theft but cannot be deemed to represent conclusive evidence that the consumer had such knowledge."
Sola Gratia, Sola Fides, Sola Scriptura, Solus Christus, Soli Deo Gloria!www.tcaregs.com