I tried searching for a previous thread on this topic and came up empty, so I apologize if this has already been addressed.

We have a customer who previously confirmed transactions as authorized (some online video game website) when we reached out to them in May. Fast forward to September and now the customer claims the same transactions that were confirmed as authorized were actually unauthorized. This feels like a case of buyer's remorse to me.

Are we able to deny the claim since the customer previously told us that the transactions were authorized? Thank you.

Long story short - responding to some sort of previous fraud alert does not impinge upon the consumer's rights to later claim a transaction was unauthorized.

Thank you for your feedback. Does the analysis change if the customer verbally informed one of our employees that the transactions were authorized?

We received a suspicious transaction notification in our BSA/AML monitoring software, so we called the customer to discuss. At that time, the customer verbally confirmed the transactions were authorized and related to a "side hustle" of our customer's. This is not a situation in which a customer responded to a text message or other automated communication method.

What's the time frame to dispute an "unauthorized" transaction? I assume if you reached out to them in May that they happened in April or May, which was likely more than 90 days ago? I thought the general rule was 60 days from the statement?

There is no timeframe on disputing. The timeframes only impact consumer liability.

so we called the customer to discuss. At that time, the customer verbally confirmed the transactions were authorized

Even with this, at best you'd have an argument of "he said." With the information you've provided, there is nothing I see that would warrant declining the dispute. Your best bet is likely to accept the dispute and if you feel like he's pulling the wool over your eyes, then show this customer where the door is.

a few of issues with this.

how do you authenticate that was really your customer you were talking to? simply the phone number on bank record? is the call recorded? any other type of authentication in place?

i'm with burkemi - you're going to be hard pressed to prove this conversation took place, much less that it was really your customer, unless you have some really good proof to help you out.

Thank you all. We will conduct an investigation and if we determine with confidence that we did speak to the customer earlier this year, we will deny the claim and more than likely close the account.

If the customer is that determined, and if it is a sizeable amount of money, be prepared (at least) for a complaint to your regulator.

Go back and read Randy Carey's 9/14/23 response. Fact is, the customer does not lose the right to claim a transaction was not authorized even if the customer has previously said it was authorized. They can respond to a fraud alert in March saying the transactions were recognized, and, after reviewing matters months later, claim they were not. You still have to do the investigation to determine whether you can verify they were authorized or not. And if you can't, you apply the consumer liability rules in section 1005.6 to determine how much you have to reimburse the consumer.

I agree with John that the customer did not lose their right to dispute the transaction just because they previously authorized it. The CFPB says this in their FAQs: "Moreover, no agreement between a consumer and any other person may waive any right provided by the EFTA. See 15 USC 1693l." In other words, just because you discussed it for fraud purposes, doesn't waive their right to dispute the transaction later.

In addition, several banks (see USAA) have been penalized for not conducting an investigation when warranted, and this situation doesn't seem that different to what other banks have gotten in trouble for.

The 60 day timeframe applies to you needing to follow the error resolution procedures in 1005.11. So technically, you wouldn't have to provide provisional credit (or follow 1005.11) if the dispute is past the 60 day timeframe. That said, consumers still have liability protections in 1005.6 past 60 days, so you still have to conduct an investigation and determine the liability of the consumer. The CFPB put it this way in their Reg E exam procedures: "Under the EFTA, there is no bright-line time limit within which consumers must report unauthorized EFTs." In other words, a consumer can report unauthorized EFTs - and have (some) liability protections - well after the 60 day time frame.

Similar situation ...
Debit Card dispute where they purchased some weight loss pills for $40, they received product but only agreed to a $40 charge and merchant charged $200. She already reached out to merchant who refused any refunds. Our Ops team said it's not a Reg E claim, however only the '$40' was authorized, wouldn't the difference of $160 be considered 'unauthorized' . I can't find any details on this gray area.. any guidance would be appreciated.

What you need is a copy of the agreement. If the consumer failed to read the fine print that indicates they agreed to recurring billing and additional charges, then you have the information you need to deny the claim. However, we are not at that point yet.

1005.11(a)(ii) defines an error as an "incorrect EFT." In this case the customer is asserting that they were charged the incorrect amount. Consequently. this is a Reg E error claim which you are required to investigate. You can't determine that no error occurred until you investigate to determine what the customer actually did authorize compared to what was charged.