We recently suffered a BIN attack on our ATM and Debit Cards, of which we identified internally. We notified via telephone the affected customers and credited back the fraudulent transaction as well as issued them a new debit card. Since we identified do we still need to send a letter regarding the credit to the account or is the phone call good enough?

The investigation requirements of 1005.11 don't apply if you self-identify and self-correct an error. See the commentary to 1005.11(a).

5. Discovery of error by institution. The error resolution procedures of this section apply when a notice of error is received from the consumer, and not when the financial institution itself discovers and corrects an error.

BrianC in this section of Reg E 1005.11 where it talks about procedures for resolving errors and under (b)(1)4. Failure to provide Statement. What would a bank do in this situation as far as notification to the customer? We found an instance where a few customers had signed up for e-statements, but didn't follow through with online banking so they didn't receive e-statements and our system didn't switch them over to paper statements. So they did not receive statements for a few months. We are planning on printing and providing those missing statements to the customers, and are sending a letter notifying them why they didn't receive the statements, but do we need to provide information in the letter about their 60-day time period? How would we word that?

Reg E has no notification requirements relating to this scenario. What it does do is extend the bank's liability window under 1005.6(b)(3) as well as the customer notification timeframes in 1005.11(b). What you choose to say to your customer is a business decision. Your error resolution team should also be aware of the affected accounts for processing claims and calculating liability for these accounts.