The fact that the son had the account info is not to be confused with authorization to debit the account, so I believe your question is moot. This isn't dissimilar to evergreen authority when a debit card is loaned, but then retrieved. It isn't evergreen. That's a myth unless the consumer doesn't retrieve the device or call the bank.
If the son gave the account info in an attempt to "steal" from dad to get the IRS off his back, that's theft in my mind. But unless dad is really well off, he didn't miss $10K for the last 7 months? I'd bet dad knew, but sonny promised repayment and hasn't. I'd let dad know you will (assuming you will) pursue this thru the police.
I don't know if there are any ACH remedies. Others will have to opine.
My opinions are not necessarily my employers.
Rules and Regs minus Relationships equals Resentment and Rebellion. John Maxwell