We had a customer that had (many) ACH unauthorized transfers done from her savings account thru internet banking. We have returned a large portion of them, but we had several thousand dollars that Fed sent back as ACH late return because they were beyond the 60 days from ACH transaction date. However these were still within the 60 day Reg. E statement period date. So my thinking is the bank is going to have to eat theset transactions. Is this correct? Also the customer had gotten 3 excessive Regulation D notices in this time period and didn't say anything at the time she got the first two notices it was only when she got that third notice that she called and notified the bank. I just need a second opinion on refunding her the money. The ACH rule VS REg E gets somewhat confusing.

You last ditch option is to request copies of the customer authorization from the ODFI. The authorization information may demonstrate that your customer did in fact authorize the charges allowing you to deny the claim, or if the originator failed to obtain valid authorizations, the ODFI may elect to allow a late return rather than be cited for a NACHA rules violation.

Otherwise, there is a good chance the bank is on the hook.

Even if those efforts don't bear fruit, there remains one card to play. That's the ODFI warranty of authorization card. It can't be played through the ACH operation, but it can be played in a direct warranty claim (think forged endorsement claims). The warranty is valid for whatever period is applicable under state law. If the ODFI can't get documentation of the authorization from the Originator and refuses to accept a late return, you can try the direct approach and consider taking court action on the warranty claim if the dollars are big enough to warrant (hah!) it.