Suspicious ATM Dispute- Deny Claim or Hold PC?

You had 10 business days after being notified of the claimed unauthorized ATM withdrawals to investigate and determine whether they were, in fact, unauthorized or not. If you completed your investigation in those 10 business days and determined that the withdrawals were unauthorized, you should not give provisional credit, you should give final credit. If you completed your investigation in those 10 business days and determined the withdrawals were authorized by your customer, then you could (and should) deny the claim. If you could not complete your investigation within the 10 business days, then you would be obligated to provide provisional credit while you continued to investigate and you could take up to 45 calendar days from the initial notice to complete the investigation. Giving provisional credit means making those funds fully available for withdrawal and/or paying clearing items. You cannot put a hold on the provisional credit. I'd also be cautious about using the fact that they withdrew the provisional credit money as a reason to deny the claim. You'd want more substantive support than that for a determination that the ATM withdrawals were authorized.