I'd suggest you tread a bit lightly here. If the story about hospitalization and not being able to contact the bank once he got home is true, make note of §1005.6(b)(4) - "If the consumer's delay in notifying the financial institution was due to extenuating circumstances, the institution shall extend the times specified above to a reasonable period," and comment 6(b)(4) - 1 - "Examples of circumstances that require extension of the notification periods under this section include the consumer's extended travel or hospitalization." While those words are associated with the timeliness of the consumer's notice to the bank of unauthorized transactions or loss or theft of an access device, I think it's pretty easy to see how they might apply to the alleged facts in your scenario.
Also, of course, we have the fact that the physical card is not the only access device here. The stored information in the FB Pay app was also an access device. That supports a position that the consumer's authorization "lived on" even after the card was returned to him.
But then there is the "she wouldn't let me have my phone back" defense from the customer, so he couldn't contact the bank until his purported "escape."
One thing only is certain here -- the consumer should be off the hook for any of his former girlfriend's transactions that may have occurred after he escaped her bullying (that is what it was, if it happened), and told his tale of woe to the bank.