If you read the back of the card I am willing to bet dollars to donuts that it says something like “This card is the property of XYZ Bank (issuer) and must be surrendered upon demand.”
The bank owns the card and has the right to cancel that cards use.
Further, because the fraud was reported to you and the bank opted not to cancel that card, the bank is liable for any valid claims occurring after that notice. Neither the EFTA (the law) or Reg E empower the bank to impose any additional liability on the consumer than the Reg provides so when the bank failed to force-close that card, you accepted the possibility of future losses.
Hopefully this will be a lesson learned and save you more in the future than this lesson costs you.