The botton line, from the bank's point of view, is that you are told to protect your cards and not give PINs etc to anybody; he broke that rule, so the fault is his. It's a perfectly understandable thing to do with a partner you trust (we do it) but he has still broken the rules.