Splitting hairs in the definitions of Reg E today.

The questions: 1) Does the Account Number become an "Access Device" when the account number is compromised and used without permission for unauthorized transactions (e.g. stolen check stock used to obtain the account number)? 2) Does the account number become an "Access Device" when it is tied to a third party app, which is then used to initiate unauthorized transactions?

Looking at liability provisions at 6(b) 1 & 2, and contrasting that with 6(b)(3)(2) ... the involvement of an "access device" is critical to making this distinction. (By the way, I'm dealing with this now and need to make a liability determination - this is not just a hypothetical)

Under the traditional line of thinking, using the definitions as they exist today, i would posit that an account number by itself does not constitute an Access Device. However, if we think "real world" that account number is the key to the kingdom and can be used digitally to access the account so how could it not be treated as an Access Device? Yes, "theft or loss" seems to imply something tangible ... but when we think about skimming, counterfeit cards, etc. is it even possible to make this distinction anymore??

A checking account number is not an access device. A debit card number, expiration date and security code used to make a purchase or initate a transfer online is an access device. See the commentary to 1005.2(a).

1. Examples. The term ”access device“ includes debit cards, personal identification numbers (PINs), telephone transfer and telephone bill payment codes, and other means that may be used by a consumer to initiate an electronic fund transfer (EFT) toor from a consumer account. The term does not include magnetic tape or other devices used internally by a financial institution to initiate electronic transfers.

2. Checks used to capture information. The term ”access device“ does not include a check or draft used to capture the Magnetic Ink Character Recognition (MICR) encoding to initiate a one-time automated clearinghouse (ACH) debit. For example, if a consumer authorizes a one-time ACH debit from the consumer's account using a blank, partially completed, or fully completed and signed check for the merchant to capture the routing, account, and serial numbers to initiate the debit, the check is not an access device. (Although the check is not an access device under Regulation E, the transaction is nonetheless covered by the regulation.