There may be several circumstances such as the case where the consumer buys prepaid card from the local big box store with their debit card and calls the thief to give them those codes. In that case the consumer willingly bought the prepaid cards and gave those to the thief.
Another case which is a real example, is where a thief convinces a teen to participate in a scam. The teen has say, $300 in his account. The thief takes the card and says he will take $200 from the account and give the teen $100. Teen is to file a claim with the bank and will get back at least $150 of the $200 “stolen.” That $150 plus the $100 the thief paid him provides an easy profit of $50 for the teen and $100 for the thief. In that case the accountholder was a participant in the scam.
By the way, what really happened is the thief went to stores and ATMs and not only cleaned out the teen's account, but Mom and Dad had the teen’s account set to draw off their deposit accounts when the balance fell to a certain floor amount. Thousands were stolen. It could have been worse if a line of credit had been established to feed the parents' account as even more funds would be available.
The liability really depends on the situation. A consumer falling for a phishing scam may provide information allowing a debit from their account. But if there was no intent to allow such a debit, that could be a valid claim.