I agree with John that the customer did not lose their right to dispute the transaction just because they previously authorized it. The CFPB says this in their FAQs: "Moreover, no agreement between a consumer and any other person may waive any right provided by the EFTA. See 15 USC 1693l."
In other words, just because you discussed it for fraud purposes, doesn't waive their right to dispute the transaction later.
In addition, several banks (see USAA) have been penalized for not conducting an investigation when warranted, and this situation doesn't seem that different to what other banks have gotten in trouble for.
What's the time frame to dispute an "unauthorized" transaction? I assume if you reached out to them in May that they happened in April or May, which was likely more than 90 days ago? I thought the general rule was 60 days from the statement?
The 60 day timeframe applies to you needing to follow the error resolution procedures in 1005.11. So technically, you wouldn't have to provide provisional credit (or follow 1005.11) if the dispute is past the 60 day timeframe. That said, consumers still have liability protections in 1005.6 past 60 days, so you still have to conduct an investigation and determine the liability of the consumer. The CFPB put it this way in their Reg E exam procedures: "Under the EFTA, there is no bright-line time limit within which consumers must report unauthorized EFTs."
In other words, a consumer can report unauthorized EFTs - and have (some) liability protections - well after the 60 day time frame.