There are countless ways scammers are working to steal your member’s ATM and debit card information, especially around the holidays. While your credit union cannot stop a thief from making fraudulent electronic funds transfers (EFT), you can shield accountholders with protections supported by Regulation E. Reg E provides a basic framework that establishes the rights, liabilities, and responsibilities of participants in electronic fund transfer systems, as stated by the Federal Reserve.

While Reg E protects your members, it places a great deal of potential liability on your credit union. How do you legally handle ATM and debit card claims under Regulation E? Elizabeth Fast, JD & CPA, outlined important requirements to obey with Credit Union Webinar Network in 2020. One point she stressed most was, “the member’s liability for an unauthorized EFT depends on whether an access device is used and when the member notifies the financial institution.” These two factors create a matrix of liability for your credit union. Elizabeth gave detailed examples of each tier, plus an easy-to-follow matrix in her webinar toolkit.

Access devices include ATM or debit cards, codes, or any devices used to access an account (even your mobile phone!). There are three tiers of liability when one is used:

• First Tier — The member’s maximum liability is $50 when they notify your credit union within two business days of learning about the theft. The two-day period only begins when the member becomes aware that their card has been lost or stolen, which could be days after the actual incident.
• Second Tier — The member’s maximum liability is $500 when they give notification after the two-business day period above, but within 60 calendar days after the first statement showing the unauthorized EFT in question. Fast expressed “this is when it is important to do the math!”
• Third Tier — The member’s maximum liability is $500 plus all unauthorized EFTs after the 60-day period detailed in the second tier. It is important to note that the 60-day period begins when your credit union sends out the statement either by mail or electronically, with some exceptions.

In cases where no access device is used, such as an ACH transaction or counterfeit card, there are two tiers of liability:

• First Tier — The member is not liable for anything if they notify your credit union within 60 calendar days of your credit union sending the first statement showing an unauthorized EFT made without an access device.
• Second Tier — If the member fails to notify your credit union after the 60-day period above, they are liable for all fraudulent transfers occurring after that period. “The first 60 days are free,” noted Fast.

Regulation E allows for your credit union to provide extra member protections, like “zero liability”. However, you cannot impose greater liability on the member by agreement. Your state’s law may also provide additional protection, in which case, the state law becomes the minimum requirement.