The PIN number could have been written on the card. Or someone could have shoulder surfed the PIN. You can't just rely on the fact that a PIN was used. Even with a PIN, it could still be an unauthorized transaction.
You can't make the Reg E error resolution contingent on filing a police report. But as Swashbuckler says, sometimes police involvement can have an amazing memory restoration effect. You are perfectly within your rights to tell the customer that you'll reimburse their claim, but that once you do so, the claim is now yours and that you intend to prosecute the perpetrators to the full extent of the law. Especially if you have cameras showing the perpetrators, you'll be amazed at how often it turns out that it wasn't "unauthorized" after all.
Jim Bedsole, CRCM, CBA, CFSA, CAFP
My posts - my opinions