Apparently your customer has made a claim that the second withdrawal was unauthorized, and wants his money back. If the facts are as you have described them, I'd agree that the transaction was unauthorized, and your customer's failure to cancel out of his live session can't be used against him in how you proceed. It's not a lost or stolen card situation, so the customer gets his money back.
You said the ATM is at another bank. That bank is the party at fault in this scenario, if you need to point a finger. Allowing the possibility of a second transactions without a second PIN entry in a card "dip and remove" reader ATM is inviting trouble.
_________________________
John S. Burnett
BankersOnline.com
Fighting for Compliance since 1976
Bankers' Threads User #8