We seem to be experiencing a few unauthorized debit card transactions from stolen cards. If I am understanding Reg E correctly, as long as the customer notifies us within 2 days from the theft, the customer is only liable up to $50. Who is liable for the rest? Our Visa processor company stated unless we could obtain the back of the card to verify that the signature does not match the sales receipt we (the bank) would take the loss. Is this correct? Where is the responsiblity of the retailer to verify the purchaser? Does anyone have any idea where I go from here? Thanks for your help.

The problem with Reg E is it's a consumer regulation. Heaven forbid that the consumer could possible suffer. The merchants are automatically authorized for up to a certain amount. That was set by your bank in the beginning. Sooooo........guess who looses? You're correct, the bank!

That's my understanding anyway.
Maria, I see you are from nearby Birmingham.(where I am at) Is your bank a member of CBAA?

Thanks bwest, but you did not make me feel any better. I agree with the reg that the consumer should not be held liable to a degree but... For example, just say my card was stolen 5 or 7 days ago and I keep alot of money in my DDA or better yet, I have a large overdraft protection. I do not realize until yesterday my card was stolen and the crook utilized say $4,000. I informed you within 2 days of my learning of the theft so I am not responsible for more than $50. Now what about the 3 or 5 days I did not know about the theft. Should I not be responsible for my card on a daily basis? And what about the retailer? Can't we go back on them? They should verify whom they are permitting to sign? Is only the bank stuck? seriously?

Yes, I am close to Birmingham. I am actually a northernor converted to a southernor. Born and raised in Ohio.

We had a customer that went to a bar where some woman stole his ATM card and spent about $900. He kept his PIN number with his card. Negligence right? No. We had to eat the $900. Banks do not realize that under the current rules WE have most of the liability. WE will be the losers.

What if I gave my debit card and PIN to someone and had them get cash or purchase merchandise then turn around and say that the purchase was unauthorized, someone stole my card, etc.? Would I lose? No - the bank would. Great scam right? Heaven help us if our customers figure this out.

Ah, Reg E and Debit cards....there's nothing better in the world.

One thing to think about is the Visa "Zero Liability" rule that, I think, actually superceeds Reg E.

If you take a look at the VISA Chargeback manual, you'll see there probably isn't a Chargeback Code for forged sales drafts. I'm in Minnesota, and our card service providor is FASTBANK. We have about three or four cases each week where the customer states a transaction is fraudulent, and it's a pain.

The first thing to do is get a copy of the sales draft. Then have your customer come in and sign an affidavit stating that they did not take part in the transaction. This is all formality, of course, because once the Merchant receives transaction authorization, it's pretty much a done deal. Unless you're lucky enough to have some little clause in your VISA providor's chargeback manual that will allow you to pass the loss off to the merchant...

These things are ugly - good luck!

In your affidavit you may want to place a clause about the bank prosecuting if the person is found. We are very lucky as we do not get this weekly but have taken losses on this issue. We have built this into the bank's risk assessment. We learned a valuable lesson with a sole proprietor and a debit card loss treated as a consumer case.

Maria,
1) if the consumer fails to notify the bank within 2 business days after learning of the loss or theft they can be liable for up to $500 maximum (Who is going to admit that they knew about it earlier?)

2) If consumer does not learn of the loss or theft and does not notify the bank within 60 days after the transmittal of the periodic statement where the unauthorized debit appears, they will be liable for up to $50 for unauthorized transactions occurring before the close of the 60 days PLUS all unauthorized transactions made after the close of the 60 day period. (hey, they can wait to tell us about it for 60 days and pay only $50 for transactions within those 2 months!)
3) If they know they lost the card but do not notify the bank........well they can suffer unlimited liability BUT only after the 60 days after the transmittal of the statement and have to pay only up to $500 for the 2 months period.

Welcome to the world of compliance! And the big bad banks are out to take the consumers to the cleaners with all our transaction fees and charges. Yea, right....... ATM and Debit cards are a real liability to the bank but we must offer them in order to compete.

It is apparent that we must do a better job in training our frontline staff on error documentation. Once the typical customer understands the rules, the story about the transaction may change. Our first questions should be "When did you FIRST learn your card (or PIN) was missing?" and "Have you ever allowed anyone else to use your card and PIN with your permission?" And as mentioned earlier, we should inform everyone presenting an unauthorized ATM transaction that we will prosecute.

I can sympathize with those bogus claim losses. We lost a large dispute with an overseas merchant claiming the card was present. Because an authorization was provided, we lost. It seems to me that we should have some protection when we can prove the customer was in the U.S. using her card on the day the transaction occurred.

Thank you all for your knowledge and experiences. I am not so upset with the consumers in our situations as I am the retailers. I do not understand how they can get their money from us (the bank) if they did not verify identification. Reg E protects the consumer which is fine, but what protects the bank with the retailer?

Earlier in this strong, "Donna Banker" wrote:

quote:

---

What if I gave my debit card and PIN to someone and had them get cash or purchase merchandise then turn around and say that the purchase was unauthorized, someone stole my card, etc.? Would I lose? No - the bank would. Great scam right? Heaven help us if our customers figure this out.

---

You might get away with this, but if any one of the transactions can be traced back to you, the bank would be advised to stick you with the whole bundle of transactions. Transactions made by a person to whom the access device was [voluntarily] given with authority to use it are not unauthorized EFTs under Regulation E. We've been able to unravel a few scams like this by getting the actual user of the card, whom we had identified from videotapes of ATM withdrawals, "rat out" the cardholder in exchange for our agreement not to prosecute. We slammed the cardholder with the transaction, shut down the account, and when the erstwhile customer complained of our heavyhandedness, we threatened to go to the cops with charges of EFT fraud, conspiracy, etc. Then we added their name to ChexSystems for good measure.

You are all right with your answers. If your debit cards have a Visa logo, you have to play by their rules instead of Reg E. The zero liability applies regardless, even when the signature is forged. The merchant is required to have the card present and the charge slip signed. It makes no difference if it is the customer who signed it. The only way these rules will change and the liability shifted to the retailers (who are in a position to prevent the fraud) will be if the banking industry unites on this issue and makes the change happen. We have incurred thousands of dollars in loss due to forged signatures in the last few years and are very frustrated.
The other problem we have is when the merchant double posts their transactions. If the amount is under $25 you also have to eat the charge as there are no chargeback rights under that amount. I suggest we open gas stations, limit the purchase to 24.99 and then proceed to double post all debit card transactions. Looks like a fast way to make money. (Just kidding)

I’ve been looking closely at the Reg E requirements.

Commentary §205.6(b)(2) discusses when timely notice is not given by the customer to the bank.

The sentence in 6(b)(2)1 (…Because the consumer is liable for the amount of the loss that occurs within the first two business days (but no more than $50), plus the amount of the unauthorized transfers that occurs after the first two business days and before the consumer gives notice, the consumer's total liability is $500 …) indicates that the customer is limited to $50 liability for any unauthorized transfers that occur after two days when the customer LEARNS of the missing card – even if the customer notifies the bank AFTER the two days of learning the card is missing.

Notification by the customer within two days of learning the card is stolen simply prevents the customer from becoming liable for an overall $500 for any unauthorized transactions that occur after the two days the customer learns of the stolen card.

For example:

My card is stolen X days ago, I learn the card is missing on a Monday but I do not notify the bank until Friday. A $600 ATM withdrawal is made on Tuesday and a $100 ATM withdrawal is made on Thursday. My total liability is $150. Why? My liability for the two days after I learned of the stolen card is $50 and because I did not notify the bank within 2 business days of learning of the missing card, I have an overall limit of $500 liability. ($50+$100)

If this is incorrect please set me on the right path…

------------------
Comments are mine and not those of my employer.

Don't forget to also check your state law on this issue! It will prevail if it has more consumer protection for your customer. Here in Wisconsin the 2 day rule does not apply. The customer is liable for $50 or less no matter when they finally decide to tell us! Another win for the banking industry

I keep reading all your replies and researching on my own too and I get sicker by the minute. We have only had two situations and they have both occured recently. The amount of money is not overwhelming but it is when you are watching your expenses (as we all are). What concerns me is what could happen in the future if this continued. A bank could really loose a ton of money. The Visa processing company we use requests copies of the signed sales receipts (no problem)and also a copy of the signed debit card (problem)in this type of situation. Now how are you going to produce the card if it was stolen? It looks like our bank is out of the money because the customers did notify us within two days. I just wish we could go back on the retailers.

Thanks for your inputs.

Opinions are mine not my employer.

Maria,

Unfortunately, VISA decided to make banks comply with the zero liability rules some time ago to encourage people to shop on-line. They figured that if people knew they would have no liability for unauthorized transactions that they would be more willing to shop on the Internet. Great idea, huh!

While our bank's are paying the price for having the logo on our cards, I would bet that we are all making money by offering the cards. I try to keep this in mind when I begin to get frustrated about these silly rules!

Also keep in mind that VISA's rules do provide that the zero liability rules do NOT apply if the bank determines that the customer was grossly negligent or fraudulent in the handling of their account or card.

Dolly Nugent
Vice President
Compliance & CRA Officer
Citizens Business Bank

You may find some Reg. E liability assistance by using a spreadsheet I have available on my personal Web site,
http://www.vvm.com/~zavoina

It will assist you in determining the liability based on the timelines of the debits, notifications, etc.

Zero liability isn't considered here, a) because the regulators won't audit for this and b) the math is pretty easy.

------------------
Andy Zavoina
Opinions stated are not necessarily that of my employer.

Andy,
If you read this again, I can not seem to download the program. It scribbles. Thanks so much for your help.

It is in a compressed (zipped) format. If you need assistance in this, e-mail me.

------------------
Andy Zavoina
Opinions stated are not necessarily that of my employer.