Source: https://www.consumercomplianceoutlook.org/2012/fourth-quarter/error-resolution-procedures-consumer-liability-limits-unauthorized-electronic-fund-transfers/
Timestamp: 2019-04-24 10:04:47+00:00

Document:
Congress passed the Electronic Fund Transfer Act (EFTA) in 1978 to protect consumers engaging in electronic fund transfers (EFTs). The law provides the legal framework for the rights, liabilities, and responsibilities of participants in EFT systems that consumers use such as automated teller machines (ATMs), debit point-of-sale terminals in retail stores, and automated clearing house (ACH) transactions such as electronic payment of a creditor’s bill from a consumer’s checking account. Regulation E implements the EFTA’s requirements.
Among its provisions, Regulation E specifies procedures that institutions must follow for investigating and resolving errors alleged by consumers for EFTs, such as an unauthorized ATM withdrawal. The regulation also specifies the extent to which a consumer can be held liable for unauthorized EFTs. To facilitate compliance, this article reviews the regulation’s error resolution and consumer liability provisions.
The consumer’s request for documentation required by §1005.9 or §1005.10(a) or for additional information or clarification concerning an electronic fund transfer, including a request the consumer makes to determine whether one of the errors listed above actually exists.
Generally, a financial institution must complete its investigation of an error within 10 business days of receiving a notice of error, but it may extend this period to 45 calendar days if certain conditions are met. The 10-business-day limit applies even if an institution received oral notice and required the consumer to provide written notice. The institution must begin the investigation promptly and cannot delay it until it receives written confirmation.7 In certain circumstances, the 10-day period can be extended to 20 days, and the 45-day period can be extended to 90 days.
Provisionally credits the consumer’s account for the full amount of the alleged error plus interest, if any. However, the institution may withhold a maximum of $50 of the amount credited if the institution has a “reasonable basis” for believing an unauthorized EFT occurred and complies with the limitation on liability rules in §1005.6(a), as discussed later in the article.
If the consumer reasserts the error and the institution completed the initial investigation in compliance with the regulation, the institution has no further responsibilities to the consumer, except when a consumer asserts an error after receiving documentation requested under §1005.11(a)(1)(vii). See 12 C.F.R. §1005.11(e).
If an institution concludes from its investigation that an unauthorized EFT occurred, a consumer can be held liable within the limitations described in §1005.6.
Notice by Third Party. For purposes of the limitations on liability under §1005.6, notice provided by a third party on the consumer’s behalf is valid.19 A financial institution may require “appropriate documentation” from the third party to ensure that the person is acting on the consumer’s behalf.
Regulation E establishes three tiers of liability for unauthorized EFTs involving an access device. The applicable tier depends on when the consumer learned of the loss or theft of an access device, when the financial institution received notice, and when the financial institution transmitted the periodic statement showing the first unauthorized transaction to the consumer.
First-Tier Liability ($50 Maximum): S1005.6(b)(1). If the consumer notifies the financial institution within two business days after learning that the access device was lost or stolen, the financial institution may only hold the consumer liable for the lesser of (a) $50 or (b) the amount of unauthorized EFTs that occurred before the institution was notified.
Consumer notifies financial institution of theft. Bank’s systems are set up to immediately freeze an account after notice of unauthorized EFT. If consumer had provided notice on Wednesday, the $600 transfer would not have occurred.
Third-Tier Liability (Unlimited): §1005.6(b)(3). If the consumer fails to notify the financial institution of the theft or loss within 60 days after the financial institution transmits to the consumer a periodic statement showing the first unauthorized EFT, the financial institution may impose liability on the consumer up to the total amount of all unauthorized EFTs occurring more than 60 calendar days after transmitting the statement and before notice to the financial institution, provided that the institution establishes that the unauthorized EFTs would not have occurred had the consumer notified the institution within the 60-day period. For unauthorized transactions that occurred before this period, the consumer is liable only to the extent that the banks could impose first and second-tier liability under §1005.6(b)(1) and (2).
Extension for Extenuating Circumstances. Section 1005.6(b)(4) requires financial institutions to extend the time limits discussed above for each liability tier if the consumer failed to notify the institution because of “extenuating circumstances.” When this occurs, the institution must extend the limits to “a reasonable period of time.” Comment 6(b)(4)-1 of the Official Staff Commentary lists hospitalization and extended travel as examples of extenuating circumstances.
Instead, an institution may only hold the consumer liable for an unauthorized EFT not involving an access device if the transfer occurred more than 60 calendar days after transmittal of a periodic statement showing the first unauthorized EFT out of the consumer’s account and before the consumer gives notice to the financial institution, provided the institution establishes that the unauthorized EFT would not have occurred had the consumer notified the institution within the 60-day period.
If either a state law or the agreement between the financial institution and the consumer provides less liability than the provisions of §1005.6, the consumer’s liability cannot exceed the limits under the state law or the agreement.
Financial institutions should review and test their policies and procedures regarding error resolution investigations and consumer liability for unauthorized transactions to ensure that they comply with Regulation E’s requirements. Specific issues should be raised with the Consumer Financial Protection Bureau or your primary regulator.
The amount of unauthorized transfers occurring after the two business days and before notice to the financial institution.
The amount of unauthorized transfers occurring after two business days.
For transfers occurring after the 60-day period, unlimited liability (until the financial institution is notified).
1 The term electronic terminals means electronic terminals through which a consumer may initiate an EFT, such as ATMs, point-of-sale terminals, and cash-dispensing machines; the term does not include telephones operated by consumers. 12 C.F.R. §1005.2(h). However, no error occurs in cases where the institution does not make a terminal receipt available for transfers of $15 or less. Comment 11(a)-6 ; see also 12 C.F.R. §1005.9(e).
10 12 C.F.R. §1005.11(c)(2)(i); see also 12 C.F.R. Part 220 (Securities Credit by Brokers and Dealers).
12 12 C.F.R. §1005.11(c)(1); Comment 1005.11(c)-1. Comment 1005.11(c)-5 states that an institution may include the notice of correction on a periodic statement that is mailed or delivered within the 10-business-day or 45-calendar-day time limits and that clearly identifies the correction on the consumer’s account.
25 Federal Reserve Board, Consumer Compliance Handbook, Regulation E at 13.

References: §1005
 §1005
 §1005
 §1005
 §1005
 §1005
 §1005
 §1005
 §1005
 §1005
 §1005
 §1005
 §1005
 §1005