Amy - your dad needs to fight the bank on all of the charges. How does the bank know that she didnt just see your stepmom using the code and then stole it. Also check on all of the charges - it may be harder to proove ATM withdrawals but anything used on credit is credit card fraud because she is not the card holder. Banks are notorious for fighting these things so he may have to push them.