Requiring a Police Report for an Unauthorized ACH
Issue/Inquiry
The Bank recently received several reports of ACH fraud. Is it acceptable to require a copy of a police report before crediting anything back to the customer? The Bank understands that this cannot be done for VISA debit cards, but it would like to know if it can do so for other ACH transactions and electronic checks.
Response Summary
What the Bank can require in writing with respect to an unauthorized ACH transaction or whether it can require anything in writing at all will depend on whether the transaction is subject to the error resolution requirements of Regulation E or those of the NACHA Operating Guidelines. Generally, the Regulation E rules will prevail for consumer transactions, unless the NACHA rules are more favorable.
Response Detail
If the Automated Clearing House (“ACH”) transactions were electronic funds transfers for the purposes of Regulation E, then the error resolution of the regulation will apply. An electronic fund transfer (“EFT”) is any transfer of funds that is initiated through an electronic terminal, telephone, computer, or magnetic tape for the purpose of ordering, instructing, or authorizing a financial institution to debit or credit a consumer's account. The term includes a transfer sent via ACH. 12 CFR §1005.3(b)(1); Official Interpretations, §1005.3(b)(1) – 2.
Under Regulation E, the Bank must comply with the error resolution rules of the regulation when it receives a written or oral notice of error from a consumer that meets the timing requirements and enables the Bank to determine the name and account number of the consumer and why he/she believes an error exists. The Bank cannot require anything in addition to this. It may request additional documentation to assist in its investigation, but it may not condition the investigation on whether or not the documentation is provided. 12 CFR §1005.11(b)(1).
This means that the Bank can request a copy of a police report as part of its investigation, but it must comply with the error resolution requirements of Regulation E whether or not the consumer provides this documentation.
The Bank may also require the consumer to provide written confirmation of an error within 10 business days of an oral notice. If it requires written confirmation, it must have informed the consumer of the requirement and provided the address where confirmation must be sent when the consumer gives the oral notification. If the consumer does not provide written confirmation, the Bank is not required to provisionally credit the consumer’s account if it requires more than 10 business days to complete its investigation, but it must still investigate the claim and credit the account if it determines that the claim is valid. 12 CFR §1005.11(b)(2); Official Interpretations, §1005.11(b)(1) – 2.
The NACHA rules require the Bank to obtain a Written Statement of Unauthorized Debt (“WSUD”) or an affidavit from the accountholder. The statement must be given under penalty for perjury in order for the Bank as the Receiving Depository Financial Institution (“RDFI”) to use the ACH system's adjustments procedures to return the item. The NACHA rules suggest that the Bank consult its legal counsel to determine whether a WSUD or an affidavit should be obtained, in order to have a written statement subject to the penalty of perjury. NACHA Operating Guidelines, OR71, OG107.
The NACHA rules concern the relationship between the Bank as RDFI and the Originating Depository Financial Institution. Such does not affect in any way the Bank’s Regulation E obligations. The Bank can treat consumers more favorably under the NACHA rules (or the VISA or MasterCard rules), if they provide equal or greater protection to the consumer, but it must provide them with, at least, the protections of Regulation E.