Unfortunately, it sounds like you must reimburse the customer. Your decision must be based on a reasonable investigation. Chargeback rights between banks have nothing to do with whether a customer's claim of unauthorized transactions is valid. That would be something to pursue under different regulations (UCC I believe). It was mentioned in a
BankersOnline webinar I attended a couple of years ago: "Reg E is not fair [for banks]." So true.
Check out the banker tools on this site for some good Reg E stuff. If you also search these threads for "+unauthorized +transaction" you will probably find some good discussions as well.