POS or PIN, it doesn't make a difference. Either way, you have to accept the claims, unless, as Whodunit said, the father previously gave the son permission to use the card, then revoked it and didn't notify the bank that the son was no longer authorized to use the card.
Also, you can ask the customer to file the police report, but you cannot require it. And if they do not file the police report, you cannot use that as a reason to deny the claim.
_________________________
Everything is possible with time and motivation