If the friend returned the card then stole it, it would fall under 3 rather than 2.
2(m) Unauthorized Electronic Fund Transfer
2. Authority. If a consumer furnishes an access device and grants authority to make transfers to a person (such as a family member or co-worker) who exceeds the authority given, the consumer is fully liable for the transfers unless the consumer has notified the financial institution that transfers by that person are no longer authorized.
3. Access device obtained through robbery or fraud. An unauthorized EFT includes a transfer initiated by a person who obtained the access device from the consumer through fraud or robbery.
The opinions expressed here should not be construed to be those of my employer: PPDocs.com