(1) A customer shall not be liable for an unauthorized use of his or her account through an electronic fund transfer unless the depository institution can prove, without benefit of inference or presumption, that the customer’s negligence substantially contributed to the unauthorized use and that the financial institution exercised reasonable care to prevent the loss. As used in this section customer negligence means only the following:

    (a) Writing the personal identification number on the card or other means of affording access.

    (b) Keeping the personal identification number with the card or other means of affording access.

    (c) Voluntarily permitting the account accessing device, including the personal identification number and the card, to come into the possession of a person who makes or causes to be made an unauthorized use.

    (2) If the customer fails to notify the depository financial institution of an unauthorized use within 30 days after the receipt of a statement conforming with section 18 and containing an unauthorized use, a customer shall be liable for a subsequent unauthorized use that could have been prevented by timely notification.

    (3) A customer shall not be liable for further unauthorized use of his or her account by electronic fund transfer after the customer has reported that the means of access to his or her account has been lost or that the security of his or her personal identification number has been violated.