If a consumer claims that an EFT from their account is incorrect or unauthorized but the access device is not lost or stolen, what is the consumers liability? Is it the same as if it involved an access decive?

are you saying that a debit card or ATM was used? or are you speaking about an ACH item?

The card could have been compromised by "skimming". It is the same error resolution process as if the card was stolen.

[If I get your card information and use that to make a purchase it isn't an accepted access device that was used. This could be skimming or just a data breach. Look at 205.6(a), 205.2(a)(1)

The liability rules apply only when an accepted access device is used.

Another example, your account number is 12345 and mine is 12354. I set up a debit to my account and the two digits get transposed. My bill is paid from your account. Here again you'd have no liability because no accepted access device was used. ]

Andy made this statement in another post. I'm really confused about liability involving "skimming". Can someone clarify?

Reg E increases a customer's liability from $50.00 to $500.00 if they do not report the loss or theft of an access device (ATM debit card) within two days of the discovery of the loss or theft.

In the case of skimming where only the card information is stolen, not the card itself, this liability schedule does not apply. Instead the normal 60 calander days from the statement date where the first fraudulent transaction occurs applies.

So if I am reading this correctly, if the error is not associated with an accepted device, the BANK does not have liability. Or the Customer does not any liability? If the customer does not have liability, does that mean the bank takes the loss? Also, does the provisional credit and the investigation period apply here as well?

Woah. I'm a little confused here. Skimming, data compromise etc., when involving a card (debit/atm) is not considered an access device claim? How?

At my former employer (and this one) we treat card number compromises (be it stripe or data) as access device claims.

Seeking clarification here.

Bump...on the last 2 posts...

If no access device was used, then the CUSTOMER has no liability (if reported within 60 days of the transaction showing on the statement). In the case of skimming (at least how I understand it), someone will retrive the card information and PIN number from an ATM machine, and then use that information to create a "new" ATM card. This new ATM card is not an accepted access device as defined by the regulation, therefore the customer has no liability (assuming proper notification). Here is an excerpt from the OSC:

2. Transfers not involving access device. The first two tiers of liability do not apply to unauthorized transfers from a consumer's account made without an access device. If, however, the consumer fails to report such unauthorized transfers within 60 calendar days of the financial institution's transmittal of the periodic statement, the consumer may be liable for any transfers occurring after the close of the 60 days and before notice is given to the institution. For example, a consumer's account is electronically debited for $200 without the consumer's authorization and by means other than the consumer's access device. If the consumer notifies the institution within 60 days of the transmittal of the periodic statement that shows the unauthorized transfer, the consumer has no liability. However, if in addition to the $200, the consumer's account is debited for a $400 unauthorized transfer on the 61st day and the consumer fails to notify the institution of the first unauthorized transfer until the 62nd day, the consumer may be liable for the full $400.