Your customer became aware of the problem transactions in January. So, assuming that you do not determine that they were authorized by your customer, or that your customer benefited from them, you start with the January transactions and when the statement listing those transactions was sent to your customer. From the date that statement was sent or made available to your customer, count 60 calendar days to determine a cutoff date. Any unauthorized transactions from the same party occurring before that cutoff date are the responsibility of the bank, and any occurring after that date are the customer's responsibility for not calling the matter to the bank's attention sooner.
Roughly speaking, if the January transactions showed up on a statement sent on January 31, the customer would be responsible for any transaction by the same party occurring after March 31.