While I would agree that grandma provided access, I'm certain the CFPB would opine on her "intentions." But g-ma gave the device and unfortunately for her, gave it in a form she couldn't really take back like with a debit card. In the case of a card, use authorization ends when the card is resecured by your consumer. If the kid steals g-mas card and uses it, that's unauthorized. Once the "code" is given and it is a defined access device, g-ma would need to close that account effectively to protect it.
As to the $90K, glad I'm not in that mess. There is no time limit to file a claim. My first recommendation would be to really dig back and ensure that you could get to the first transfer in the claim and establish the statement + 60 day period for unlimited liability to the consumer. The bank's loss would likely be a small part if the thefts were regular over 18 months.
_________________________
AndyZ CRCM
My opinions are not necessarily my employers.
R+R-R=R+R
Rules and Regs minus Relationships equals Resentment and Rebellion. John Maxwell