IBA Compliance Connection

Your go to source for compliance!

One of our customers recently reported unauthorized ACH transfers out of her deposit account. The unauthorized transactions started over five months ago. Are we liable for the last sixty days of unauthorized transactions, or for the first sixty days of unauthorized transactions?

—

by

admin

Your bank may be liable for the unauthorized transactions that occurred within sixty days after transmitting the first periodic statement containing the unauthorized transaction. Your customer is liable for the unauthorized transactions that occurred after the sixtieth day, due to her failure to notify your bank.

Under Regulation E, when a customer fails to report an unauthorized transaction within sixty days after it appears on a periodic statement, the customer faces unlimited liability for unauthorized transfers that occur after that sixty-day period (up to the date on which the customer notifies the bank about the unauthorized transactions). However, the bank still must reimburse the customer for the unauthorized transactions that occurred during that sixty-day period.

For resources related to our guidance, please see:

  • 12 CFR 1005.6(b)(3) (“A consumer must report an unauthorized electronic fund transfer that appears on a periodic statement within 60 days of the financial institution’s transmittal of the statement to avoid liability for subsequent transfers. If the consumer fails to do so, the consumer’s liability shall not exceed the amount of the unauthorized transfers that occur after the close of the 60 days and before notice to the institution, and that the institution establishes would not have occurred had the consumer notified the institution within the 60-day period.”)
  • Official Interpretations, Regulation E, Paragraph 6(b)(3), Comment 2 (“For example, a consumer’s account is electronically debited for $200 without the consumer’s authorization and by means other than the consumer’s access device. If the consumer notifies the institution within 60 days of the transmittal of the periodic statement that shows the unauthorized transfer, the consumer has no liability. However, if in addition to the $200, the consumer’s account is debited for a $400 unauthorized transfer on the 61st day and the consumer fails to notify the institution of the first unauthorized transfer until the 62nd day, the consumer may be liable for the full $400.”)