Identity Theft: Dispute Resolution October 22, 2015 Dustin DeVore, - - PowerPoint PPT Presentation

kaufCAN.com

Identity Theft: Dispute Resolution

Dustin DeVore, Esq.

Kaufman & Canoles, P.C. 4801 Courthouse Street Suite 300 Williamsburg, VA 23188 dhdevore@kaufcan.com

October 22, 2015

Hazel C. Wong, Esq.

Kaufman & Canoles, P.C. Two James Center 1021 E. Cary Street, Suite 1400 Richmond, VA 23219 hcwong@kaufcan.com

kaufCAN.com

Dustin H. DeVore, Esq.

Kaufman & Canoles, P.C.

4801 Courthouse Street, Suite 300 Williamsburg, VA 23188 (757) 259.3808 dhdevore@kaufcan.com

Hazel C. Wong, Esq.

Kaufman & Canoles, P.C.

Two James Center 1021 East Cary Street, Suite 1400 Richmond, VA 23219 (804) 771-5782 hcwong@kaufcan.com

2

kaufCAN.com

Identity Theft: Dispute Resolution Strategies

• Liability for Unauthorized Transfers
• Error Notification and Dispute Resolution
• How to recognize
• How to avoid
• Checklist and guidance
• Best Practices

3

kaufCAN.com

Is your credit union ready to address identity theft? Yes No

4

kaufCAN.com

Identity Theft: Dispute Resolution Strategies

• Regulation E limits a member’s liability
• “Zero liability” provisions in contracts

with credit cards

• Result: credit union bears liability

5

kaufCAN.com

Regulation E

• Implements the Electronic Fund Transfer Act
• Protects members engaging in electronic fund

transfers – Automated teller machines (ATMs) – Automated clearing house (ACH) transactions such as electronic payment of a bill from the member’s account

• Procedures for investigating and resolving errors
• Limitations on member liability

6

kaufCAN.com

Dispute Notices & Error Resolution

Errors include:

• An unauthorized EFT;
• An incorrect EFT to or from a member’s

account;

• An omission of an EFT from a member’s

periodic statement;

• A computational or bookkeeping error by

the institution for an EFT;

7

kaufCAN.com

Dispute Notices & Error Resolution

• A member’s receipt of an incorrect

amount of money from an electronic terminal;

• The members request for additional

information or clarification concerning an electronic fund transfer, including a request the member makes to determine whether one of the errors listed above actually exists.

8

kaufCAN.com

Dispute Notices & Error Resolution

Not included:

• Routine inquiries about a member’s

account balance,

• Requests for information for tax or other

record-keeping purposes, or

• Requests for duplicate copies of

documentation

9

kaufCAN.com

Does your credit union have a detailed Dispute Resolution Policy? Yes No

10

kaufCAN.com

Notice of Error Requirements

• Must act on any error notification from a member
• received within 60 days after transmitting the

periodic statement on which the error is first reflected enables the credit union to identify the member’s name and account number;

• indicates why the member believes an error

exists; and

• includes, to the extent possible, the type, date,

and amount of the error.

• Can require that the member submit a notification in

writing within 10 business days after oral notice

11

kaufCAN.com

Response Timeframe

• Must complete investigation within 10 business days of

receiving the error notice

• May extend to 45 calendar days if:
• Unable to complete investigation within 10 business

days

• Provisionally credit the member’s account
• Inform member of the amount and date of the

provisional crediting within two business days of the crediting; and

• Allow member full use of the provisional funds during

the investigation

12

kaufCAN.com

Response Timeframe

• Requiring written notice will not extend

the 10 business day period, but if not received within 10 business days of the

• ral notice, can extend to 45 calendar

days without provisionally crediting the member’s account

13

kaufCAN.com

Results of Investigation

After completing the investigation, you must:

• Correct an error within one business

day after determining that an error has occurred; and

• Report the results of investigation to

the member within three business days of completing investigation

• Report must be in writing

if you conclude there was no error

14

kaufCAN.com

Unauthorized Transfer Defined

• Initiated by a person other than the

member

• Without actual authority
• Member receives no benefit

15

kaufCAN.com

Unauthorized Transfer Defined

Does not include an EFT initiated:

• By a person furnished the access device

to the member’s account by the member, unless the member has notified the credit union that the authorization has been revoked

• With fraudulent intent by the member or

any person acting with the member; or

• By the credit union

16

kaufCAN.com

Limiting Liability

Disclose to members

• A summary of the member’s liability for

unauthorized transactions

• The telephone number and address of the

person or office to be notified of an unauthorized EFT

• The credit union’s business days

Must provide a means to identify the owner or authorized user of an access device (debit card)

17

kaufCAN.com

Liability for Unauthorized EFTs Involving an Access Device

• 3 tiers of liability for unauthorized EFTs

involving an access device

• when the member learned of the loss or theft of an

access device,

• when the financial institution received notice, and
• when the financial institution transmitted the

periodic statement showing the first unauthorized transaction to the member.

18

kaufCAN.com

Liability for Unauthorized EFTs Involving an Access Device

1

st Tier: Member notifies credit union within two

business days after learning that the access device was lost or stolen

• member liable for lesser of (a) $50 or (b) the

amount of unauthorized EFTs that occurred before the institution was notified

19

kaufCAN.com

Liability for Unauthorized EFTs Involving an Access Device

2nd tier: Member notifies credit union within 60 days of the statement containing the error

• member liable for lesser of:
• $500 or
• the sum of: (see next slide)

20

kaufCAN.com

• the member’s first-tier liability; and
• the amount of unauthorized EFTs that
• ccur after the end of the second

business day after the member learns

• f the loss or theft and before notice to

the credit union (provided the credit union establishes that the unauthorized EFTs would not have

• ccurred had the member provided

notice within two business days after learning of the loss or theft)

21

kaufCAN.com

Liability for Unauthorized EFTs Involving an Access Device

3

rd tier: member fails to notify the financial institution of

the theft or loss within 60 days after the financial institution transmits to the member a periodic statemen

• credit union may impose liability on the member up to

the total amount of all unauthorized EFTs occurring more than 60 calendar days after transmitting the statement and before notice

• must establish that the unauthorized EFTs would not

have occurred had the member notified the credit union within the 60-day period

22

kaufCAN.com

Liability for Unauthorized EFTs Not Involving an Access Device

Member may not be held liable for any portion of any unauthorized EFT not involving an access device that occurred on or before the 60th calendar day after the transmittal of the periodic statement showing the first unauthorized EFT

23

kaufCAN.com

Liability for Unauthorized EFTs Not Involving an Access Device

Member liable for EFTs

• unauthorized
• not involving an access device
• occurring more than 60 calendar days after

transmittal of a periodic statement showing the first unauthorized EFT

• occurring before the member gives notice to

the credit union

• the EFT would not have occurred had the

member notified the credit union

24

kaufCAN.com

Prepaid Accounts

• Upcoming Rule on Prepaid Products
• Will establish new consumer protections
• Limits on consumers’ losses when

funds are stolen

• Error investigation and correction
• Free access to account information

25

kaufCAN.com

Does your credit union offer members resources to avoid identity theft? Yes No

26

kaufCAN.com

Risk Management

• Don’t wait until your members notice or experience

identity theft

• Act early by having a holistic approach in place to

help detect suspicious activity

• Reputation risk is critical when it comes to identity

theft

• Employee awareness training
• Cyber security and data protection policies and

procedures

• Due diligence of third party providers

27

kaufCAN.com

Strategies to Minimize: Member Notification

• Requirement to notify members and NCUA

when there has been a direct data breach of the credit union’s system maintained by it or its third-party service provider

• Member notification in all data breach contexts

may help to mitigation against the risk of fraudulent or unauthorized transaction

28

kaufCAN.com

NCUA GUIDANCE

Guidance on Response Programs for Unauthorized Access to Member Information and Member Notice contained in Appendix B to Part 748 of NCUA Regulations

29

kaufCAN.com

Customer Regulation E Dispute Checklist

• 1. Disputes can only be for transactions no older

than 60 days from the most recent statement.

• 2. Disputes must be returned to the bank no later

than 10 days from when the error was identified.

• 3. Note that POS/ATM disputes may take up to 90

days until resolved.

• 4. Provisional credit may be revoked if not

approved.

30

kaufCAN.com

Customer Regulation E Dispute Checklist

5. Before submitting a claim, try to contact the merchant to receive credit. 6. When submitting a claim, provide a statement which includes the following:

• a legible, detailed description of the disputed item;
• the date, time and amount of the disputed item;
• any information regarding the purchase and be as

specific as possible (When did you cancel (date/time)? Where is the merchandise/product? When did you return?);

31

kaufCAN.com

Customer Regulation E Dispute Checklist

• any authorization regarding the transaction or any

benefit you received from the transaction;

• any and all information you have regarding any

contact with the merchant for credit.

• any authorization regarding the transaction or any

benefit you received from the transaction;

• Any and all information you have regarding any

contact with the merchant for credit.

• 7. Include any proof of purchase, sales receipt or

payment method with claim.

• 8. Have you given your card number or pin to anyone?

32

kaufCAN.com

BEST PRACTICES

• Repeatedly inform the members
• Information is restricted to employees with

specific business purposes

• Employees trained to maintain confidentiality

and member privacy

• Assurance that credit union procedures

comply with Federal regulations and leading industry practices

33

kaufCAN.com

What Members Can Do to Protect Themselves

Repeated education of the members to do at least the following:

• Enter personal information only on secure websites
• Never respond to emails asking for personal credit union
• r credit card information
• Never use email to send confidential information since

internet email is not secure

• Do not open emails if you do not recognize the sender’s

name

• When in doubt, delete!

34

kaufCAN.com

What Members Can Do to Protect Themselves, Cont’d

• Change passwords regularly using a mixture of

upper, lowercase characters and numbers

• Use passwords that are not easily guessed
• Do not share password information with anyone
• Be wary of promotional scams
• Update anti-virus software and security patches to

your system regularly

• Tear up or shred any pre-approved credit offers that

you do not want

35

kaufCAN.com

Identity Theft: Dispute Resolution

Dustin DeVore, Esq.

Kaufman & Canoles, P.C. 4801 Courthouse Street Suite 300 Williamsburg, VA 23188 dhdevore@kaufcan.com

October 22, 2015

Hazel C. Wong, Esq.

Kaufman & Canoles, P.C. Two James Center 1021 E. Cary Street, Suite 1400 Richmond, VA 23219 hcwong@kaufcan.com