Reg E 1005.11 (e) Reassertion of error. A financial institution that has fully complied with the error resolution requirements has no further responsibilities under this section should the consumer later reassert the same error, except in the case of an error asserted by the consumer following receipt of information provided under paragraph (a)(1)(vii) of this section.
Commentary to Reg E 1005.11(e) Withdrawal of error; right to reassert. The financial institution has no further error resolution responsibilities if the consumer voluntarily withdraws the notice alleging an error. A consumer who has withdrawn an allegation of error has the right to reassert the allegation unless the financial institution had already complied with all of the error resolution requirements before the allegation was withdrawn. The consumer must do so, however, within the original 60-day period.
Since you did not actually investigate, the customer may reassert her claim unless she is outside the 60 day period from the delivery date of her statement on which the first unauthorized charge appeared. If that time is passed, you may deny the claim. You may also determine that V/MC Zero Liability does not apply if the cardholder was negligent with her card.
However, if she is not outside of the 60 day period, she may file her claim and the bank is obligated to investigate according to 1005.11, and the cardholder's liability calculated according to 1005.6. Since you have a known suspect, you may choose to involve law enforcement to aid in recovering the funds from junior, and you may choose not to give grandma another card.
I will touch on what we can and cannot do regarding family related fraud on Wednesday at my webinar
The Maze of Debit Card Compliance