I'd start by simply telling the customer that "Sam made the withdrawal and he's a joint owner of the account with the same withdrawal rights you have. I you file a claim that Sam's withdrawal was unauthorized, we will have to process it, but we will deny it."
If the claim is filed, you have to process it. My investigation period would take about 5 seconds. The written notice to the customer from that investigation would have been something like "The transaction was completed by Sam, and he is a joint owner of this account, with the same withdrawal rights you have. We have decided the transaction was not unauthorized, and we won't be making an adjustment to your account. You can ask us for the documents (the account signature card) we used in making this determination."
John S. Burnett
Fighting for Compliance since 1976
Bankers' Threads User #8