It is A, B and C, page 636:
The OCC has determined that a national bank may not assume that, simply because a consumer’s PIN or ATM card was used in a transaction, that the transaction is authorized. Banks are required to take reasonable steps to determine whether the transaction was authorized. Such steps might include the bank’s review of: i. Documentation or written, signed statements provided by the consumer
NOTES
ii. Historical information on the customer’s pattern of use (such as time, location, types of transactions, and so on)
iii. Location of the transaction in relation to the customer’s home, place of business, and normal shopping locations
iv. Customer’s location at the time of the transaction v. Problems reported by other customers regarding the access device or ATM
vi. Signature information on POS transactions vii. Police reports viii. Film from security cameras, if available