We have a customer who was traveling in Mexico. On the way to the airport, their taxi driver told them he needed to take their passports to get them through customs. At the airport, the driver told the customer he needed to pay a fee to get his passports back or police would be called. Customer handed over his debit card.

This gets into the "cardholder was tricked but willingly made a transaction" area - similar to someone buying gift cards because a fraudster posing as an FBI agent on the phone told them they had to or else they would be charged with a crime/arrested.

What causes me to pause is the fact that the transaction was done in person and the customer's passport was held. This veers closer to the commentary in 12 CFR1005.2(m) that states that a transfer initiated by a person who obtained the access device from the consumer through fraud or robbery is an unauthorized EFT. This situation also is similar to the comment about "forced initiation."

Thoughts?

Without a bit more information, it sure seems like this could meet the definition of an unauthorized EFT. You said they handed over the debit card? Did the taxi driver just take it (a robbery) and use it as his own? Or, was the customer essentially forced to withdraw funds (forced initiation)? And how much was the dispute?

3. Access device obtained through robbery or fraud. An unauthorized EFT includes a transfer initiated by a person who obtained the access device from the consumer through fraud or robbery.

4. Forced initiation. An EFT at an ATM is an unauthorized transfer if the consumer has been induced by force to initiate the transfer.

Scams like this are apparently commonplace when travelling abroad. The customer was foolish to hand over their passport. You might do that with a tour guide you booked through a reputable service but not your taxi driver. The threat of not getting your passports back (kind of needed to leave the country) and the threat of arrest would create a situation where their actions were done under duress in which case their authorization would not be valid.

without a doubt the customer has no liability here, call it fraud, duress, or any other name you want, but the customer did not willingly make this transaction, he was forced to make it.

I've posed this type of question before and got a different response stating "The official interpretation relating to a transfer performed under duress was solely focused on a withdrawal at an ATM. There has been no subsequent guidance from any agency on this topic."

I took it to mean that the forced initiation exception shouldn't be interpreted beyond ATMs. It's simply silent. It's further complicated when we apply this exception to a spectrum of say immediate physical threat (literal gun to the head) to a potential psychological or reputational threat like sextortion (figurative gun to the head.) What gets covered and not? There is simply no good guidance.

All that to say, it looks like you are looking for a reason to accept the dispute, not deny it. So long as you do it consistently, you won't get in trouble for reimbursing your customers.

Good point, St. Matthew. I agree that the official interpretation does relate to duress during an ATM withdrawal. However, as Regulation E is very consumer-friendly, and we know that the regulators (CFPB) have been working to address outdated aspects of the rule, I would be very cautious about denying this type of transaction without more information that justifies the denial. When you rule your investigation on the side of the consumer, this more conservative approach ensures compliance as you won't have scrutiny of a possible Reg E violation. For many, they will likely just look at the dollar amount of the transaction and, if it a low amount, won't think twice about refunding the customer. If the dispute is pretty big, they may likely work to gather more information and have a risk decision as to the appropriate action to take. The reality of this situation is, as Happy said, "the customer did not willingly make this transaction, he was forced to make it."

The official interpretation is not itself the rule, but further information on how to interpret the rule. Forced initiation is still forced initiation. The actual fact hasn't changed - the customer did not willingly authorize this transaction.

But where's the line of forced? Any threat no matter how empty or transparent? Will a cold call from an "agent" to either pay or be arrested no be "forced" and thus unauthorized? Pay or we release these suggestive AI Photos of you? Peer pressured to buy the latest X-Box game?

Blanket statements aren't going to work, so I'm a little hesitant to take this interpretation and run it beyond it's specific scope. Even with the Reg E consumer favorability, this seems like this opens the flood gates for a customer to just pay a ransom without any scrutiny because it was "forced" and they know'll it'll be covered.

then view it on a case by case basis. here, it appears the client would be stuck in mexico without paying. sure hate to deny the claim and have the local news affiliate do a "news on your side" broadcast highlighting how the client was trapped in mexico, had to pay to get out, and the bank denied the claim because the client handed the card over.

News interviewer: Can you tell me what happened?

bank client: yes, the driver conned us from our passports, and the only way to get those back to leave the country was to pay a "fee" to him. we had no choice otherwise we would still be stuck in mexico

news interviewer: so you paid the fee and then what happened?

bank client: we told our bank, Bank of St Matthew, what happened and asked for our money bank. the bank said since you gave the the card we are not eligible for a refund of what was stolen clearly by fraud

news interviewer: we reached out to bank of St matthew and they initially had no comment. heck, i wouldn't either if i left my clients out to dry in a foreign country...back to you in the newsroom, Jane

jane in newsroom: this just in, Bank of St matthew said this has all been a mistake and of course they would be reimbursing the bank client. no word if our story forced them to do the right thing or not, but there we are...

I'm far from a Reg. E expert, but if the "victims" had handed over cash instead of their debit card, this would be a non-issue right? I guess the lesson to learn as a consumer is....if you're ever duped, pay with your debit card, not cash.

If the bank's Reg. E decision impacts whether they could be stuck in Mexico....wouldn't they still be stuck in Mexico in your scenario? I don't see it that way....the only way they're getting stuck in Mexico is if the debit card didn't work. After that, it's just whether the consumer or the bank is left paying for the decision that began with a Mexican cabbie who "needed their passports". In my opinion...it's not about giving the cabbie their debit card....it's about giving him their passports. I'm not sure that news program would have the same impact on every viewer that you think it would....i think plenty of viewers would think "why should the bank pay for their stupidity?".

Happy, this only outlines an argument from reputational risk and does not offer any regulatory insight. I was hoping to define
"force" as a regulatory expectation, but its Reg E and am not surprised if I dont get one... It's just a fine line between this being a scam or being "forced". Did they even say "no", "give it back" and were "forced" or did they just hand it over because they thought the passport fee was legit?

I 100% agree with all the other risk factors considered outside of the Reg E rule being applied here (reputation, $ amount for the transaction involved, etc.)

And for the record, The Bank of St. Matthew (Patron Saint of Bankers) would never!

I just don't think the average person would be outraged. To me, it's the equivalent of:

Person A: "I got robbed in the parking lot as i was leaving work. The thief took $1000 from me."

Person B: "I hope you sued your employer to give you the $1000 back."

I understand what Reg. E is and a good part of what it says....but i don't think most people are outraged when they hear that another person was duped and the big old bad bank didn't eat the loss for them. Now i understand in a lot of cases, that's exactly what the bank has to do. But i really don't understand why, especially in scenarios like this. Stolen card, sure.

You're correct that you won't see any regulatory guidance on this specific scenario because none exists. The regulation was written in 1978 so it tracts that the commentary only discusses "forced" withdrawals at an ATM because debit cards didn't exist in 1978. The reason we have these discussions is because regulatory language has not kept pace with technological enhancements for the processing of payments.

As a consultant, my clients often ask the question, "Can I deny the claim if...?" Sure, you can deny any claim you want but be prepared to justify the strength of your investigation to an examiner. I can point to specific examples where the bank's interpretation of what is an adequate investigation did not match the examiner's.

In its Reg E FAQS, the CFPB makes multiple references to scenarios where it cited banks based on these differences.
1005.2(m) says that the customer is liable when they grant authorization to a third party to initiate an electronic funds transfer. Many banks denied claims when a customer gave their debit card information in response to a third-party scam phone call or phishing email citing that definition. However, the CFPB countered with the interpretation that an access device obtained through robbery or fraud places liability on the bank and cited banks for failure to file claims.

Denying the claim related to the taxi driver carries the same compliance risk. You can go with the interpretation that the cardholder was foolish in giving their card to the taxi driver instead of just demanding the return of their passport, or you can conclude that the taxi driver's actions constitute coercion, robbery or fraud and honor the claim. No one here can tell you what an examiner will conclude, so be prepared to defend your answer and push back if this claim is denied and selected as a testing sample. As a risk adverse auditor, my recommendation would be to pay the claim under these circumstances. I'd also attempt a chargeback for "services not as described" or "services not rendered" to see if I can recover funds through VISA/Mastercard as the cab company may have a tough time justifying this charge.

Thank you all for your responses and a fascinating conversation. Makes me feel a bit better that we couldn’t come up with/ a clear cut answer either.