Reg E fraud claims: do two specialists reach the same answer?

Reg E fraud claims are customers' notices that an electronic fund transfer from their account was unauthorized, and a bank must investigate each one, decide within 10 business days or provisionally credit, and repay the transfer if it was unauthorized. The test of whether a desk decides them well is not only whether each answer can be defended, but whether two specialists given the same evidence would reach the same answer. On person-to-person payments that test is rarely run, and the clearest public evidence is a year-to-year swing in repayment rates that the law did not explain. P2P Fraud Claims, Botminds' software for dispute teams that resolve P2P fraud and scam claims, measures consistency on every draft by finding decided claims with the same facts and showing how they went.

This guide is for the QA analysts and Regulation E compliance officers who test decided claims. It sets out what consistency means for a P2P claim, how to measure it, and how to fold it into the monthly testing a bank already does.

What are Reg E fraud claims?

A Reg E fraud claim is a consumer's notice that a transfer was unauthorized: started by someone other than the consumer, without actual authority, and with no benefit to her, which is Regulation E's definition in 12 CFR 1005.2(m). It is one of the errors Regulation E's error-resolution procedure covers, alongside incorrect transfers and bookkeeping errors. The bank must investigate promptly, report the result within three business days of finishing, and correct an error within one business day of finding it.

On P2P payments the word "fraud" carries a narrower meaning than customers give it. Banks and the network generally use "fraud" for unauthorized payments and "scam" for payments the customer was tricked into sending herself, and only the first is a Regulation E error. A claim the customer calls fraud may contain both. Consistency testing has to start from that split, payment by payment, or it will compare claims that only look alike.

Is fraud covered under Reg E? The Senate's numbers say coverage did not settle the answer

Unauthorized transfers are covered, yet at the three largest owner banks of the Zelle network, the share of fraud disputes repaid moved by as much as 14 points in a year. The Senate Permanent Subcommittee on Investigations, which reviewed the banks' dispute data for 2019 to 2023, found that they "collectively reimbursed consumers for approximately 38%, or $64 million, of the $166 million worth of fraud disputes at these banks in 2023". In 2019 the share had been 62%.

Regulation E did not change in those years. Its error-resolution section was last amended in 2018. Something else moved: the mix of claims, the evidence available, the bank's policies, or the judgement of the people applying them. The Senate staff could not say which, and that is the point. A rate that swings without a rule change is a signal a desk should be able to explain from its own data, and only a consistency measure can explain it.

What the Senate found about discretion

The staff report's finding on how the banks investigated is the strongest public case for consistency testing. After reviewing the three banks' procedures, the staff concluded that "the policies and procedures allow broad discretion to bank employees reviewing disputes", and that it could not tell whether anyone checked the results: "It is also unclear the extent to which, if at all, review is performed by the Three Banks to ensure that determinations made by bank employees are consistent with their policies and procedures, and in accordance with the requirements of EFTA and Regulation E."

The report also broke repayment down by age. In 2022, an average of 35% of transactions disputed as fraud by consumers 18 and under were reimbursed, against 55% for consumers 36 to 50, 66% for those 51 to 65 and 68% for those over 65. The staff did not establish why. Different claim mixes could explain part of it. But a desk that can group its claims by the facts that decide them can test whether customers with the same facts got the same answer, whatever their age, and a desk that cannot group them cannot answer the question at all.

What is a twin claim?

A twin claim is a decided claim whose payments share the facts that decide placement: who started the payment, on which device, after what authentication, to what kind of recipient, after what kind of impersonation if any. Two claims for different amounts, on different days, from different customers are twins if those facts match. Twins are the unit of a consistency test, because they are the cases where a different answer cannot be explained by different evidence.

Defining the facts matters more than the matching. A twin definition that ignores the device will pair a passcode-takeover payment with a payment the customer sent herself, and report disagreement that is really correct. One that includes the amount or the customer's age will find almost no twins. In the solution, the consistency agent groups by the decisive facts the classification agent already records for each payment, and a draft that differs from 80% or more of its twins needs a reason code from the specialist before it can go forward.

Each kind of claim beside its twins, and the decisions that differed

How do you test consistency of fraud claim decisions?

Test consistency in three layers: agreement between a draft and its decided twins, agreement between two specialists working the same claim blind, and the rate at which compliance testing reverses a decision. Each catches something the others miss. Twin agreement shows drift across the whole book. Blind double-working shows whether individual judgement varies on the same evidence. Reversals show whether the agreed answer is the right one, since a desk can be consistently wrong.

The fourth row matters more as AI enters the desk. When agents propose placements, the rate at which specialists override them is the cheapest consistency measure a bank will ever have, provided every override carries a reason. A desk whose specialists never override is either running a near-perfect system or not reading the evidence, and a tester should find out which. The broader question of what agents may do on a claim is covered in claims fraud using AI.

How often should denied Reg E claims be reviewed?

Every month, on a sample, and with a specific question: did the investigation meet the bank's burden of proof? The Federal Reserve's Consumer Compliance Outlook states the floor plainly, "A financial institution cannot deny a consumer’s claim of an error without conducting a reasonable investigation.", and describes what a bank's own testing of denials can confirm: for each denied claim in the sample, that staff looked at everything relevant in the bank's records and that the findings carried the bank's burden of proving no error occurred. How to run that test as an audit is in the Reg E audit checklist.

Consistency adds one step to that review. For each denial in the sample, the tester pulls its twins. A denial that most twins went the other way on is the first to examine, because it is either an error or a fact the twin definition missed. In the solution, compliance draws the monthly sample from the same screen that lists decisions that differ from their twins, so the two tests share one worklist.

What do examiners check in Reg E fraud claims?

Examiners check whether each claim was investigated promptly, reasonably and in full, whether the reasons for a denial are ones Regulation E accepts, and whether the customer was told why in writing. The CFPB's published exam findings show the denial reasons that fail. One institution denied a claim, despite the consumer describing the theft of his debit card, because he could not say how his PIN had been learned. Others denied claims for no reason except that the consumer had bought from the merchant before. The full list of reasons examiners reject is in Reg E denial reasons.

Both are consistency failures in disguise: a single shortcut applied to every claim that shares a surface feature, whatever the evidence. A twin test built on the right facts catches that pattern, because the shortcut produces denials whose twins, grouped by evidence rather than by surface, were repaid. The CFPB's FAQs on electronic fund transfers record the same lesson in its finding that a bank turned down disputes out of hand whenever the consumer had paid the same merchant before.

What happens when two analysts disagree on a fraud claim?

The disagreement should be resolved on the evidence, recorded with a reason, and fed back into testing, never settled by seniority or by whichever analyst touched the claim last. In practice that means a defined escalation: the specialist who disagrees with a proposed placement moves it with a reason code; a draft that differs from most of its twins goes to the supervisor with that reason; and the compliance officer reviews the reasons in aggregate each month.

In the solution's sample book, three claims where a specialist had placed passcode-takeover payments as authorized, because the customer shared the code, were reversed in compliance testing with reason R-3, wrong rule. That is the disagreement a consistency system exists to catch: 211 twins went one way, three went the other, and the three were wrong. The rule they missed is explained in is Zelle covered by Reg E.

The draft outcome, decided payment by payment, with its twins beside it

How do you measure claim decision quality month by month?

Measure it as a small set of numbers reported the same way every month, by kind of claim, with the reasons behind every reversal and override. A single overall accuracy figure hides the problem the Senate staff found, because the claims that vary are a minority inside a mostly consistent book. The checklist below is a starting design a Regulation E compliance officer can adapt.

P2P Fraud Claims does the grouping and the twin search on every draft, and the design target is that every placement is checked against similar decided claims before anyone signs. It does not set the bank's threshold for what counts as consistent enough; that is the compliance officer's call, recorded as a setting with a version. The sample book on this page can be followed from P2P Fraud Claims.

Questions people ask

What are reg E claims?

Regulation E claims are consumers' notices of an error in an electronic fund transfer to or from their account: an unauthorized transfer, an incorrect transfer, an omitted or misrecorded transfer, or a request for documentation. The bank must investigate and decide within 10 business days, or provisionally credit and take up to 45 days.

Are scams covered under Reg E?

A payment the customer sent herself after being deceived is generally not an unauthorized transfer under Regulation E, so the bank is not required to repay it under that rule. A transfer a scammer started with a code or login the customer was tricked into sharing is unauthorized and is covered, which is why many scam claims contain covered payments.

What is a reasonable investigation under Regulation E?

It is a review of all relevant information in the bank's own records about the claim, not only the payment instructions. Regulation E's Official Interpretations list examples such as the account's recent transaction history and the location of the transaction relative to the consumer.

How big should a Reg E testing sample be?

Regulation E does not set a sample size. Banks size samples to their volume and risk, and a consistency design adds a targeted sample of the claim types with the lowest twin agreement, because that is where errors concentrate.

What reversal reasons do compliance testers record?

Common reasons are a wrong rule applied, a missing or unreviewed record, a late or missing notice, and an undocumented policy exception. Recording one reason per reversal lets a desk see whether its problem is training, data or policy.