Section 205.6 of Regulation E sets limitations on consumer liability for unauthorized electronic fund transfers. An unauthorized transfer is any transfer from consumers' accounts not done by the consumers, without their authorization, and from which consumers receive no benefit. It is any transfer initiated by a person acting with the consumer for fraudulent purposes and any transfer initiated by a financial institution itself. The financial institution has the burden of proof that the transfer is authorized. There are three conditions for imposing liability on the consumer: (1) the access device must be an accepted device, (2) the financial institution must have provided the means through which the consumer is identified (signature, photograph, electronic confirmation, etc.), and the institution must have made liability disclosures (establishing the liability limitations, the telephone number and address for notification in case of loss or theft of access card, and the financial institution's business days). If the bank has met these three conditions, it can impose liability on the consumer. If the card is lost or stolen, the maximum liability is $50 unless (1) the consumer fails to notify the bank within 2 business days of the loss/theft, in which case the maximum fine is $500; and (2) the consumer fails to notify the bank within 60 calendar days of transmittal by the institution of an unauthorized transfer notice, in which case the consumer bears all liability for further transfers from that day. These time periods can be extended if there are extenuating circumstances such as illness. If faced by consumer complaints, examiners should check the bank's own compliance files and procedures to determine whether the liability amounts banks have imposed are in compliance with regulations.