The Reg has no guidance on this other than § 1005.14. I would use this to my advantage. PayPal doesn’t hold the account and did issue an access device for use. The bank has no agreement with PayPal for access, so I would push them to PayPal as they have the facts of the transfers which the bank does not. In the interest of customer service I might ask the customer to let us know what is said, but as the Reg is
written, the claim is on PayPal. If the bank opts to entertain a claim, it should do so consistently with all similar claims.