Key Reg E issues are, did the customer do it, authorize it, or benefit from it? If he in fact never gave the PW to the son he didn't do it or authorize it. Did he benefit from it? That may be questionable, it's on a device presumably under his control and being used by his son, and he has a license to use it but in front of a jury of 12 your chances would be slim.
I'd look at what is after the "statement + 60 day" rule to see how much falls in the unlimited tier of liability as to your real exposure. I'd ask when dad learned of the very first charge and did he just wait until it accumulated to being real money before he brought it up? I'd also ask, will the bank file a police report - realistically and is dad going to spend more money on his son's lawyer or does dad want his son arrested and to go to court to teach him a lesson? Banks don't often push these issues and do not talk about it if you won't. Empty threats do not pay off. Lastly, when the smoke clears ask yourself if you want this customer on your books. Dad may just come back later with another claim but better answers as to what he didn't know.
My opinions are not necessarily my employers.
Rules and Regs minus Relationships equals Resentment and Rebellion. John Maxwell