Your customer gave his wife permission to use the card, not the individual who stole it. Reg E covers these transactions. Depending on when the customer learned of the theft and notified the bank, you can use the liability schedule in 1005.6 to assign a portion of the liability to the cardholder.
Since the cardholder failed to maintain the security of the card/PIN, you also have to decide whether or not it is worth the risk to give this customer another card.
Sola Gratia, Sola Fides, Sola Scriptura, Solus Christus, Soli Deo Gloria!www.tcaregs.com