MasterCard has announced changes to its zero liability policy applying to MasterCard debit cards that become effective October 17, 2014. The changes were announced in a press release, but details about the changes are not publicly available. However, based on reports about the MasterCard revisions, we believe that Regulation E change in terms notices are necessary to disclose the changes to customers before they go into effect.

Regulation E requires a change in terms notice at least 21 days before the effective date of a change that will result in increased liability for the consumer. 12 CFR 1005.8(a)(1)(ii). As we understand the MasterCard rule changes, they will increase customer liability for certain unauthorized transactions:

• Under current MasterCard rules, a customer’s liability for unauthorized transactions is limited to $50. Zero liability applies if the customer (1) has an account in good standing, (2) exercises reasonable care, and (3) did not report two or more unauthorized transactions in the past twelve months. If a customer does not meet those conditions, the $50 liability limit applies.

• Under the new MasterCard rules, a customer’s liability for unauthorized transactions could be unlimited. Zero liability applies if the customer (1) exercises reasonable care and (2) promptly reports the unauthorized transactions. If a customer does not meet those conditions, the $50 liability limit no longer applies. As a result, the Regulation E liability rules apply — but Regulation E provides a $50 limitation on liability only if a customer reports an unauthorized transaction within two business days. 12 CFR 1005.6(b)(1). A customer could have up to a $500 liability for transactions reported after the two business day period is up (12 CFR 1005.6(b)(2)), or even unlimited liability for transactions reported after sixty days have passed since a financial institution has sent a periodic statement including the unauthorized transactions (12 CFR 1005.6(b)(3)).

Because the new MasterCard rules remove the $50 limit on liability for customers who do not meet MasterCard’s zero liability conditions, the new MasterCard rules will result in increased liability for such customers. As a result, we recommend providing a change in terms in notice 21 days before the change becomes effective. If your institution will implement the change on the MasterCard effective date of October 17, 2014, you would need to mail or deliver the notice by September 26. If your institution chooses to implement the change at a later date, you would need to mail or deliver change in terms notices at least 21 days before your institution begins imposing the new liability rules.

A member of the IBA Compliance Division (which is open to any employee of an IBA member institution) was kind enough to provide the following sample language for change in terms notices. As provided in the Regulation E commentary, this notice could be included in a periodic statement or by sending a revised disclosure statement with attention directed to the change. Official Interpretations, 12 CFR 1005, Paragraph 8(a), Comment 1.

Sample Language for Change in Terms Notices:

IMPORTANT CHANGES TO RULES AFFECTING YOUR MASTERCARD^® DEBIT CARD

Effective October 17, 2014, MasterCard^® will apply its zero liability policy to PIN-based debit card and ATM transactions when fraud occurs. This zero liability will apply to PIN-based debit card and ATM transactions as long as you exercise reasonable care in safeguarding your card and promptly report the suspected fraud to us. If you fail to meet the conditions for the zero liability policy, federal law extends certain protections to consumers. Under this law, if you report the loss to us within two business days, federal law caps your responsibility at $50. If you report it within 60 days of receiving a statement that shows the fraudulent transactions, your liability is capped at $500. If you don’t report it within 60 days, that liability is unlimited.