The answer depends on when the customer notified you that their card was lost/stolen.
Reg E allows you to assign the customer $50.00 of liability if the customer notifies you within 2 business days of their discovery that the cards were missing, $500.00 for charges between days 3-60, and unlimited for any transactions done in excess of day 60.
Note that these timeframes are based on the customer discovering the cards were missing, not the date of the first charge.
Also any signature based purchases would be given Zero Liability by VISA/MasterCard.
Sadly, the bank will be on the hook for most of this. You will have to make a risk based decision whether or not to give this couple a new set of cards.
_________________________
Sola Gratia, Sola Fides, Sola Scriptura, Solus Christus, Soli Deo Gloria!
www.tcaregs.com