It sounds like the employee signed and cashed a check after the customer withdrew their authorization. If this is correct then don't assume its a fraud situation. You need to get some more facts.
Ask the customer if the employee was notified they no longer had authorization. Did the customer suffer any loss as the result of this check being cashed? Perhaps it was legitimately a final pay check. While the signature was unauthorized the customer may have had to pay the amount anyway. The customer should not Profit for this. They can get mad any holler at bank employees for being careless, but no loss no reimbursement.
IMO You need to get more information before handing over dollars to the customer.
_________________________
Compliance Analysis and Research - Software for your CRA/HMDA analysis needs