Hacked PC - Who Takes the Loss?

A bank's customer has signed up for the bank's online banking program. The customer also signs up for bill pay using the bank's bill pay application. The customer’s PC has been hacked between the customer's PC and the bank's computer system. The bad guy has control over the customer's PC and can now see ID, passwords, everything. The bad guy transfers money out of the customer's account to a valid DDA account in Florida. The customer in the Florida bank was hired by the bad guy to keep $500.00 and wire the rest of the money out of the country. The customer in my bank sees his DDA statement and sees the bad transaction(s). He comes to the bank and dispute the items. The bank says sorry, the loss is yours; you should protect your PC better. Who has the loss, the customer with online banking or the bank? Is the customer protected because of Reg. E? Reg E was not written for online banking and bill pay, but maybe it extends coverage to now include online banking? Do you know of any legal cases in the US that might help address this as well?