Answer:
My thoughts are that your online banking agreement and debit card agreement should address what you will allow your customer to do and not do with their access devices and also identify when they are liable for granting authority to third parties to access their account. You should ask your legal counsel to review applicable state law and the agreements to ensure the institution is protected, however you choose to approach these requests.