1005.6(b)(1) - (2) only apply if an accepted access device was used. Since that is not the case here, you would follow the 1005.6(b)(3) based on the periodic statement and the $50 / $500 tiers would not apply.
Have you checked with the customer to see if the charges beginning in January 2024 are also unauthorized? If so, then the notice of error would not be timely since we are way beyond 60 days from the transmittal of the January statement.
Now, if the notice of error was not timely, note that 1005.11(c) does not apply so you do not have to provide provisional credit, and you do not have to complete your investigation in 45/90 days. As stated in the commentary of that section, you must still follow 1005.6(b) if you conclude the transactions are unauthorized.
If this is the case, the bank and the charges are unauthorized, the bank would likely be liable for changes from January 2024 - March 2024, and the customer liable for everything else. As noted by burkemi, you could attempt chargebacks on the more recent transactions to see if you can gather information to determine if these are truly unauthorized or not. If you have any chargeback recoveries, you must pass these along to the customer as well. Visa/Mastercard do not allow you to keep chargeback proceeds to offset against other transactions.
_________________________
Sola Gratia, Sola Fides, Sola Scriptura, Solus Christus, Soli Deo Gloria!
www.tcaregs.com