Ideally, you would have some type of form (and certainly some training) to walk you through this process. NEVER let the customer know of any "outs" that may exist for the bank. Document, very specifically, and make sure the customer understands that an investigation will be conducted and the bank will prosecute the offender. Also, make sure you note that he is signing an Affidavit of Unauthorized Transfer under penalty of perjury (if you use that form).
Questions will vary based on the nature of the transaction. For an ATM you would certainly ask how someone else could possibly have gotten the card and/or PIN? Did you have possession of your card on this date? Have you ever given anyone your card and/or PIN? Was it returned to you? Do you think they could be involved? Have you filed a police report? If so, can we get a copy.
If you can see where the transaction occurred...Have you ever conducted a transaction with this merchant?
I tend to agree with the others. If you have made this process too simple (and not followed through with formal investigation), he may think he has found free money. You definitely need to hot card the card and may need to terminate the relationship depending on the results of your investigation.
_________________________
Life without Jesus is like an unsharpened pencil - it has no point.