There is no statute of limitation on Regulation E. Customer liability is based on how promptly the report the loss or theft of an access device (or if they provide notice within 60 days of the transmittal of the statement on which the first unauthorized charge appeared) according to 1005.6(b). In your example the bank would likely be responsible for the first three charges from 24-22 months ago and the customer on the hook for the rest (assuming you conlcuded that transactions were unauthorized.
_________________________
Sola Gratia, Sola Fides, Sola Scriptura, Solus Christus, Soli Deo Gloria!
www.tcaregs.com