Compliance Blog

Written by Shereefat Balogun, Regulatory Compliance Counsel

This time of year usually drums up incidents of unauthorized transactions and subsequent error disputes from consumers to recoup their money.  Shoppers ran to their favorite retailers with their debit and credit cards in tow, to catch those alluring Black Friday, Small Business Saturday, and Cyber Monday sales.  And it's not over! Christmas and more holiday sales are still underway.  Indeed, shoppers are busy and so are the fraudsters.

Generally, cardholders who are victims of unauthorized transactions will notify the credit union of an error and may obtain a refund from the credit union.  If the credit union determines that the cardholder's request is valid, it will withdraw funds that were previously deposited into the merchant's bank account and return the money to the member.  This post will remind credit unions how to process error disputes under Regulation E (for debit cards) and Regulation Z (for credit cards).  
 

Processing Debit Card Error Disputes under Regulation E

Regulation E, section 1005.11 governs the error resolution procedures for electronic fund transfers (EFTs) like ATM or debit card transactions. Section 1005.11(a)(1) provides the types of errors covered by the rule, which includes unauthorized electronic transfers.  An unauthorized electronic transfer is one that is initiated by a person other than the member without authority to initiate the transfer. 

Notice of Error from Member

A credit union's obligation to investigate is triggered once it receives a written or oral notice of an error from the member. The notice must be received by the credit union no later than 60 days after delivery of the periodic statement on which the alleged error is first reflected.  The notice must comply with the content requirements set forth in 1005.11(b).  If the credit union receives an oral notice, the credit union may require the member to give written confirmation within 10 business days of the oral notice.  See, 12 C.F.R. §1005.11(b).  
 

Investigation

After the credit union receives a timely notice from the member, the credit union must conduct an investigation.  Section 1005.11(c)(1) requires a credit union to investigate and determine whether an error occurred within 10 business days of receiving the notice and to report the determination to the member within 3 business days.  Moreover, the credit union is required to correct the error within 1 business day after determining that an error occurred. The 10-day investigation period may be extended to 45 days, if the credit union provisionally credits the member's account in the amount of the alleged error within 10 business days of receiving the notice. However, provisional credit can be withheld if the credit union requires, but does not receive, written confirmation within 10 business days of an oral notice of error.  Lastly, the 45 days may be extended to 90 days if the unauthorized electronic funds transfer resulted from a point-of-sale debit card transfer. See, 12 C.F.R. §1005.11(c).

Credit unions often ask us if they are allowed to require affidavits or police reports from members who report unauthorized use of their debit card.  Regulation E does not permit a credit union to require documentation such as affidavits or copies of police reports as a requirement to start an investigation.  Rather, as explained above, the regulation requires the credit union to start the investigation as soon as it receives notice (oral or written) of an error.  My colleague Stephanie Lyon wrote a great blog on this topic earlier this summer.

Member Liability

So even where there is unauthorized use on the car, a member may be held liable if he/she fails to timely notify the credit union.  Under Regulation E, there are three possible tiers of member liability for unauthorized EFTs depending on the situation.  A member may be liable for: (1) up to $50; (2) up to $500; or (3) an unlimited amount, depending on when the unauthorized EFT occurs.  Specifically, the $50/$500 tier and the amount of liability imposed will be based on whether timely notice was given to the credit union.  See, 12 C.F.R. §1005.6.

If the member notifies the credit union within two business days after learning of the unauthorized use, the member's liability is capped at $50.  If the member fails to notify the credit union within two business days, the $500 liability cap applies.  Also, note that if the member's delay in notifying the credit union was due to extenuating circumstances, the two-day limit must be extended.  The commentary to the rule explains that extenuating circumstances include travel.  This is worth highlighting, as many people travel during the holiday season and this may come up as a reason for not notifying the credit union sooner. The member can also be subject to unlimited liability if the member fails to notify the credit union within 60 days. 

Notably, under Regulation E, negligence is not a factor in determining a consumer's liability for unauthorized EFTs under Regulation E.  So whether the member was silly for shopping on a seemingly suspicious website, or was irresponsible for leaving her debit card in the fitting room while trying on some new items, is irrelevant.

Lastly, credit unions should be aware that the liability rules described above may be different for VISA/Master Card purposes. In late 2014, the card networks adopted zero liability provisions as applied to debit and ATM cards, thus VISA and MasterCard branded debit cards may be subject to different liability provisions.  Credit unions are advised to consult with the credit card network's rules for compliance purposes. 

Processing Credit Card Error Disputes under Regulation Z

Regulation Z, section 1026.13 governs billing error resolution for credit cards.  Similar to Regulation E, Regulation Z, section 1026.13(a) defines the types of errors covered by the rule, which also includes an unauthorized use of the card.  See, 12 C.F.R. §1026.13(a)(1).  Unlike Regulation E though, another error covered by the rule would be where a member alleges that, while the transaction was authorized, the good or service was not received, or it was received but not in the form he/she agreed to. See, 12 C.F.R. §1026.13(a)(3).  This may happen where Member A ordered a flat screen TV from Amazon, and although it may have shipped, it was never received by the member; or even more funky, the member order a 32" flat screen but only received a 26" flat screen. The commentary gives other examples, such as when the member refuses to take delivery of goods because they did not comply with the contract; or the wrong quantity was delivered; or the delivery was late.

Notice of Error from Member

Unlike, Regulation E where a notice of error can be oral or written, a credit union's obligations under Regulation Z are triggered once it receives a billing error notice in writing.  Like Regulation E, the notice must be received by the credit union no later than 60 days after delivery of the periodic statement on which the alleged error is first reflected.  See, 12 C. §F.R. 1026.13 (b).

Investigation

The credit union is generally required to mail or deliver written acknowledgment to the member within 30 days of receiving a billing error notice, and to resolve the error no later than 90 days after receiving the billing error notice from the member.  See, 12 C.F.R. §1026.13(c). The rule establishes error resolution procedures where: (i) the billing error occurred as alleged by the member; and (ii) a different billing error or no billing error occurred.  If the credit union determines that a billing error occurred as claimed by the member, the credit union would be required to correct the error and credit the member's account in the amount disputed, and mail or deliver a correction notice to the consumer within 90 days of receiving the notice of error.  See, 12 C.F.R. §1026.13(e).

Regulation Z does not have the same 10-day provisional credit requirement as Regulation E.  Although there isn't a provisional credit requirement, note that the credit union cannot try to collect the disputed amount while conducting its investigation.  See, 12 C.F.R. §1026.13 (d)(1)(emphasis added).

Lastly, it's worth highlighting that under Regulation Z, 12 C.F.R. §1026.12, a member has the right to assert certain claims and defenses against the credit union concerning property or services purchased with a credit card, if the merchant was unwilling to resolve the dispute; that is, as against the credit union, the member can assert any claims or defenses that can be asserted against the merchant.  So going back to our flat screen TV example, if the member disputes the receipt of the item with Amazon, and Amazon fails to resolve the issue, the member can assert certain any claims against the credit union.  Moreover, the member would be permitted to withhold payment up to the amount of credit extended for that television.  See, 12 C.F.R. §1026.12(c). 

In addition to Regulation E and Regulation Z, the credit union may also need to consider card association rules (i.e. MasterCard and Visa) because they have some specific contractual requirements dealing with provisional credit that may be more beneficial to the member than the regulatory minimums. Accordingly, the credit union would need to review those rules for provisions governing provisional credit.

Member Liability

Regulation Z defers to Regulation E's liability provisions where the error dispute claimed is for the unauthorized use of a credit card involving an EFT.  See, 12 C.F.R. §1005.12(g).  Notably, there aren't any regulatory provisions that govern member liability in the situation that doesn't involve unauthorized use, i.e., where the member makes a dispute concerning an undelivered item. 

Again, don't forget about those Visa/Master Card rules.  In addition to Regulation E and Regulation Z liability provisions, the credit union may also need to consider the card association rules, namely the zero liability provisions. 

The use of credit cards and debit cards will be prevalent this holiday season, and with the rise in cyberattacks and other fraud schemes, we may see an uptick in error disputes in the upcoming months. 

I know this was a lot of information, but it's real out there! Oh, and if you hadn't had enough, on Wednesday, the Federal Reserve Board published a report containing information on debit card transactions in 2015, including information on fraud losses.  The report states that debit card fraud losses increased by 44 percent from 2013 to 2015.  See, I told you it's real!

As always, if you have any questions relating to this issue or any other general concerns, feel free to reach out to your NAFCU compliance team. We're here for you!