In theory, anyway, this shouldn't be considered theft. The bank provided its customer with the account and the card, etc. etc. The bank then failed to regulate (govern) the account, etc. in accordance with its own policies.
Undoubtably, there was a contract, and the customer owes the money to the bank, but to charge the customer with a crime for taking money that the bank gave him stretches traditional concepts of criminal law.
These circumstances are significantly different from, for example, a person writing a fictitious check to a third party. The transactions at issue were solely between the bank and its customer.
It is understood that creating and enforcing criminal statutes may be necessary to help advance technological change, mitigate risk, etc., but this is the type of transaction that the banks should be fully capable of policing on their own, by now.
