Our bank has been very generous in handling error resolution/unauthorized transaction claims for Reg E. I recently completed a review of the process, and have recommended we begin invoking the $50/$500 consumer liability provision when possible.

So, we got our first applicable one today, and I want to make sure I got it right....

Customer noticed a $375 unauthorized ATM withdrawal from the Netherlands (using her debit card). The next day she notified us of the transaction.

Back when she opened the acocunt, we provided disclosures concerning consumer liability provisions and all other disclosure requirements per 205.7(b).

I say we fulfilled all the requirements of 205.6(a), and can reduce her refund by $50, thereby only giving her $325.

I don't believe Visa's zero-liability policy applies, because this was an ATM transaction.

Is this correct? It feels wierd to withhold full reimbursement for the customer.

I always thought that if it was a VISA Debit card, although used at an ATM machine, you were required to give the full refund under the VISA Regulations. Perhaps I am wrong. It will be interesting to see other responses.

You also need to consider if the $50 is worth losing the customer. I could see if the claim involved a major dollar amount, but we're talking $50.

This case seems as though the card has been counterfeited and not lost or stolen. My institution does withhold the liability on counterfeit transactions only on lost/stolen atm transactions. The reasoning behind this is: in counterfeit cases we cannot be sure how the info was compromised and the level of responsibility of the customer, but in lost/stolen cases they had to have left the pin with the card.

Dollar bill, the zero liability applies to transactions processed through the Visa network which generally does not include ATMs.

I think the only time the $50/$500 liability should be assigned to the customer is when their carelessness or negligence contributed to the loss. I know Reg E doesn't allow you to assign greater liability based on negligence, but you are allowed to assign this limited liability on that basis. For a customer who has not been negligent or careless, but still experiences an unauthorized transaction, why would you say to that customer, "We're sorry for your loss. We're not going to screw you over a lot, just a little, because the law allows us to do that."? Face it, most banks encourage their customers to take advantage of electronic transactions because it is more efficient for the bank that way and less costly (more profits). So when a customer does what you want them to do and then you still punish them when something bad happens, it seems counterproductive. I think that's where Visa came up with their zero liability policy.

It's the same way with Reg Z restitution issues. Reg Z and TIL allow you a tolerance that you can use when calculating the refund so that you don't wind up refunding the full amount of the error. But how do you explain that if the customer asks about it? By the same token, how do you explain to this ATM customer that they are still going to get dinged for $50? "Sorry, but that's just your bad luck for accepting a debit card in the first place. You don't expect the bank to bear the full risk for your engaging in this dangerous behavior, do you?"

RebekahL: You are correct about the Visa Zero Liability rule. It doesn't apply to ATM transactions. However, although I happen to agree with Jim using the same logic, there is another reason I don't believe you can stick the customer with the first $50 of this loss.

The customer isn't liable for any unauthorized transfer made with an access device that is not an accepted access device. I don't think you can argue that a counterfeit ATM card used in Europe when the real card was sitting safely home in your customer's wallet is an "accepted" access device.

Thanks everyone! Great comments by all. We'll give her a full refund, and determine the general circumstances in which we'll assign liability to the consumer.

You may find the Reg. E Liability Calculator helpful.

But there are flags to consider such as discussed here, is it an authorized access device, when were you notified and when were the debits taken, could the debits have been prevented, is it a zero liability issue, etc.