Do the $50 & $500 limits on liability apply on a Reg E claim where the unauthorized charges were made using a debit card number, but the debit card was never lost or stolen and was still in the customers possession?

I have a claim where the customer is disputing 4 charges (recurring debit card charges) on 10/4/23, 11/4/2023, 12/4/23, & 1/4/24. The customer notified us on 1/3/2024 and stated the card was not lost or stolen. The customers first statement showing the charge was on 10/25/2023 - so the last charge on 1/4/2024 would be outside of the 60 day window. My thought was, we are responsible for refunding the first 3 charges and the customer is responsible for the 1/4/2024.

Since their card was not lost or stolen, I don't believe the timely notification listed in 1005.6(b)(1) & (2) apply. Am I on the right track here??

My Reg E department refunded the customer for the full amount. While I know we aren't going to go back and reverse any credits, I want to make sure I explain this correctly to them for future reference.

Thanks!

Posted 1/4/24. The customer notified us on 1/3/2024

If that was the case, why was the 01/04/24 transaction allowed to post?

Randy....because it was a debit card transaction that had already been approved. I was told there was no way to reject it at that point.

That is a network issue and has nothing to do with Regulation E. Whether you can return any of these transactions is not relevant to the consumer's liability. They notified you prior to that transaction posting to their account.

Ok...and that totally makes sense. And they did receive a refund for it. What I am confused about is whether the $50.00 & $500 liability come into play if the debit card was not lost or stolen. The reason I ask is because I was trying to use the Reg E tool here on BO and it was figuring customer liability of $50.00 as well as the last charge. I don't know if I'm entering something incorrectly or just don't understand the Reg like I thought I did. The charges were each $49.60 and the tool kept saying they should receive a refund of &98.80? Maybe I was entering something wrong.

THat is because the first two tiers of liability apply when an authorized access device was used. If no card was used, the burden is on the bank to show the device used was authorized and if your consumer doesn't admit to using it, and the merchant doesn't have proof who gave it, you pay the claim with zero liability. Make sense?

Back to the OP, the liability tiers apply period to Reg E. The second question is, was it an authorized device?

I call fill out the online order form for vitamins. They send them. I fail to cancel. They use the card again, that's authorized.

If it turns out the vitamin seller got hacked and my card info was used to but a TV online, that's unauthorized.

Thank you Andy - that does make sense. I appreciate your help!