Good question for a case study at a compliance school. The people who get it right will base their answer on the highlighted portion of the following:
(m) Unauthorized electronic fund transfer means an electronic fund transfer from a consumer's account initiated by a person other than the consumer without actual authority to initiate the transfer and from which the consumer receives no benefit. The term does not include an electronic fund transfer initiated:
(1) By a person who was furnished the access device to the consumer's account by the consumer, unless the consumer has notified the financial institution that transfers by that person are no longer authorized;
(2) With fraudulent intent by the consumer or any person acting in concert with the consumer; or
(3) By the financial institution or its employee.
The commentary even provides a scenario almost identical to yours:
2. Authority. If a consumer furnishes an access device and grants authority to make transfers to a person (such as a family member or co-worker) who exceeds the authority given, the consumer is fully liable for the transfers unless the consumer has notified the financial institution that transfers by that person are no longer authorized.
Your customer could have told your bank to suspend the card at any time when the "friend" failed to return it as requested. Your customer did not have to wait until she received her statement.
In this world you must be oh so smart or oh so pleasant. Well, for years I was smart. I recommend pleasant.