We recently received a Regulation E claim from a customer regarding fraudulent charges to their account that first occurred two years ago and have continued since that time. Is there a time limit for how long a customer has to submit a claim? For overdraft fees and interest that may have been imposed due to the fraudulent charges, do we need to examine only the sixty-day period since the first fraudulent charge, or do we need to review the last two years and credit back any resulting fees and interest?

No, we do not believe there is a time limit on filing a claim for unauthorized transactions under Regulation E. We believe your bank likely will be required to credit the customer for any unauthorized transactions that occurred during the first sixty days following the periodic statement reflecting the initial fraudulent transaction. We also believe you will be required to credit the customer for all fees and interest imposed in relation to the fraudulent transactions over the last two years.

Regulation E requires you to credit the customer for the unauthorized transactions that occurred during the first sixty days after you transmitted a periodic statement showing the initial unauthorized transaction. Under Regulation E, when a customer fails to report an unauthorized transaction within sixty days after transmittal of the statement showing the unauthorized transaction, they are liable for the amount of any unauthorized transfers that occur after that sixty-day period (up to the date on which the customer notifies the bank about the unauthorized transactions). However, the bank still must reimburse the customer for the unauthorized transactions that occurred during the initial sixty-day period after transmittal of the statement.

The Commentary to Paragraph 11(c) of Regulation E provides that if a “financial institution determines that an error occurred . . . it must correct the error (subject to the liability provisions of §§ 1005.6(a) and (b)) including, where applicable, the crediting of interest and the refunding of any fees imposed by the institution.” Since the liability provisions of Section 1005.6(b) state that a “consumer’s liability shall not exceed the amount of the unauthorized transfers that occur after the close of the 60 days and before notice to the institution,” we do not believe they are responsible for any fees or interest imposed in relation to the unauthorized transfers. In other words, the consumer’s liability is limited to “the amount of the unauthorized transfers” and no more. As a result, we believe you should credit your customer for all fees and interest imposed in relation to the fraudulent transactions over the last two years.

For resources related to our guidance, please see:

Regulation E, 12 CFR 1005.6(b)(3) (“Periodic statement; timely notice not given. A consumer must report an unauthorized electronic fund transfer that appears on a periodic statement within 60 days of the financial institution’s transmittal of the statement to avoid liability for subsequent transfers. If the consumer fails to do so, the consumer’s liability shall not exceed the amount of the unauthorized transfers that occur after the close of the 60 days and before notice to the institution, and that the institution establishes would not have occurred had the consumer notified the institution within the 60-day period. When an access device is involved in the unauthorized transfer, the consumer may be liable for other amounts set forth in paragraphs (b)(1) or (b)(2) of this section, as applicable.”)

Regulation E, Official Interpretations, Paragraph 6(b)(3), Comment 2 (“Transfers not involving access device. The first two tiers of liability do not apply to unauthorized transfers from a consumer’s account made without an access device. If, however, the consumer fails to report such unauthorized transfers within 60 calendar days of the financial institution’s transmittal of the periodic statement, the consumer may be liable for any transfers occurring after the close of the 60 days and before notice is given to the institution. For example, a consumer’s account is electronically debited for $200 without the consumer’s authorization and by means other than the consumer’s access device. If the consumer notifies the institution within 60 days of the transmittal of the periodic statement that shows the unauthorized transfer, the consumer has no liability. However, if in addition to the $200, the consumer’s account is debited for a $400 unauthorized transfer on the 61st day and the consumer fails to notify the institution of the first unauthorized transfer until the 62nd day, the consumer may be liable for the full $400.”)

Regulation E, Official Interpretations, Paragraph 11(c), Comment 6 (“If the financial institution determines an error occurred, within either the 10-day or 45-day period, it must correct the error (subject to the liability provisions of §§ 1005.6(a) and (b)) including, where applicable, the crediting of interest and the refunding of any fees imposed by the institution. In a combined credit/EFT transaction, for example, the institution must refund any finance charges incurred as a result of the error. The institution need not refund fees that would have been imposed whether or not the error occurred.”)