Under the Electronic Funds Transfer Act (15 USC 1693g), a consumer is liable without limit for unauthorized transfers if (a) the consumer fails to report the unauthorized transactions within 60 days after the bank sends the consumer a statement showing the unauthorized transactions, and (b) the bank can show it would have avoided the later unauthorized transactions if the customer had notified it within 60 days. This decision holds that the plaintiff consumer in this case was not excused from the duty to report unauthorized transactions. She may have been traveling abroad, but a person of her means could easily have arranged to view the statements the bank had made available on the Internet. Also, she was not excused by the fact that her bank was notified by a third party (a receiving bank) that the second transaction was unauthorized. EFTA clearly requires notice by the consumer, not a third party to avoid unlimited liability. However, the third party notice is not without effect. It created a factual issue which could not be resolved on the pleadings as to whether notice the bank would have avoided further loss if it had received timely notice from the consumer. State law claims for breach of contract and implied covenant were properly dismissed. The bank’s disclosures about its privacy policies imposed no contractual obligations on it. The bank did not act in bad faith in failing to freeze plaintiff’s account after notice from the receiving bank of the second unauthorized transaction.