On June 4, the Consumer Financial Protection Bureau (CFPB) issued a frequently asked question and answer guide. Regulation E, in part, establishes limitations on a consumer’s liability and requires investigations of consumers’ claims of unauthorized electronic fund transfers. This FAQ concerns unauthorized transfers governed by Regulation E.

The first and second questions deal with a third party fraudulently inducing a consumer to make an electronic fund transfer and share account access information, respectively. The first answer confirms that if a third party fraudulently induces a consumer to give out his/her information, this is an unauthorized funds transfer, and the consumer’s liability is limited. The second answer states that a consumer who provides account access information to a bad actor is not considered to have furnished an access device under Regulation E. The third FAQ reaffirms that a financial institution cannot consider a consumer’s negligence in determining liability for an unauthorized funds transfer, which is already stated in Regulation E, 12 CFR § 1005.6; Comment 6(b)-2.

Moreover, the fourth and fifth answers state that a financial institution cannot modify or waive the consumer’s liability via agreement as Regulation E has an anti-waiver provision, and private card network rules can only enhance consumer protections, not lessen any protections.

The sixth and seventh FAQs state that a financial institution cannot require a consumer to file a police report as a condition before conducting an investigation nor can it require the consumer to contact the merchant before an investigation may begin.

The final FAQ asks how a financial institution determines the consumer’s liability, if any. The CFPB answers this question by referring to sections within Regulation E and stating that if a consumer provides timely notice and the financial institution determines that the transaction is an unauthorized fund transfer, the liability protections for the consumer would apply. However, the consumer may have some liability depending if he/she timely reported the unauthorized transfer within the constructs of Regulation E.