We are in the process of creating a business/commercial suite of checking products and services. I am interested in how others approach liability limits in regards to comprimised debit cards.

For simplicity, do you tend to set the notification limits the same as consumer cards as set by Reg E, or something more strict or looser? How about liability limits?

Why should the bank want any of the liability? I suppose I'd first see what the current V/MC guidance is on this, (anyone?) and then I'd look at taking on the absolute minimal amount possible to have a viable product.

You might Google the terms and see if other banks have their agreements online.

We just rolled out business debit cards. Like you we struggled for a bit with the liability, but then discovered that MasterCard instituted zero liability for business debit cards last September. The zero liability does not kick in for PIN based or transactions not processed by MC.

Both MasterCard and Visa now have zero liablity provisions on qualifying transactions. Below is taken from the Visa Business Zero Liability site. We made sure we spelled out items 2 and 3 very clearly in our debit business card agreements.

1 Visa's Zero Liability policy covers U.S.–issued cards only and does not apply to ATM transactions, PIN transactions not processed by Visa, or certain commercial card transactions. Cardholder must notify issuer promptly of any unauthorized use. Consult issuer for additional details or click here.

2 Financial institutions may exclude from the Zero Liability policy a transaction made by a person authorized to transact business on the account and/or a transaction made by a cardholder that exceeds the authority given by the account owner.

3 Visa Business cardholders may be required to notify their financial institutions within 60 calendar days of the mailing date of the first statement showing any unauthorized transactions. Financial institutions may impose greater liability on the cardholder if the financial institution reasonably determines that the unauthorized transaction was caused by the gross negligence or fraudulent action of the cardholder—which may include your delay for an unreasonable time in reporting unauthorized transactions.

4 Provisional credit for unauthorized Visa transactions will be extended to Visa Business cardholders within five business days from receipt of notification. Financial institutions may require written confirmation of the unauthorized Visa transactions before providing provisional credit.

Thanks for all of the great leads folks!

The website you pulled this from is for Visa "credit" cards...not debit cards. My understanding is that on a business debit card the bank has no liability - any fraud activity falls upon the business as they are not covered under Reg E.

bbsgrant, if you will pm me your email, I have something I can send you regarding this.

(It's not that I'm not wanting to share to the rest of the world, but there's a reason I don't want to post it in here)

The Visa rule applies to its CARDS -- both debit and credit. The business rule is somewhat more restrictive than its consumer card rule.

You are correct that Regulation E doesn't apply to Regulation E, but that does not affect Visa/MC from having rules protecting business cardholders.