Since the pin number was being used to withdrawl cash, the bank suspects one of two things.
1). It was an inside Job. either one of your mother's friend's, or family members commited the crime.
2). You mother did not safeguard the pin number, and someone found the pin number, and got ahold of her card, and used it. The banks have been using the "Safeguarding of the Pin" as an reason for not reimbursing for Fraud.
I have a question for you that could help to disprove theory #2. Did your mother ever use her ATM card at a gas station, movie theater, or anywhere else to pay for goods or services?
If the answer is yes, then it could have left her open for fraud, because savy criminals have been placing devices inside the card reader, that captures the information on the card, and the criminals retreive this information later, and they then produce atm cards, and use the pin to clean out the account. This practice is knowm as skimming.
The fact that she cancelled her card, and probably got a new pin indicates 1 of two things. 1). Either this was an inside job,or 2) she went back to the same merchant who's machine was set up for "skimming", and they got her information again.
Your mother is a victim, and proving skimming will be very difficult. Even if you can prove skimming took place, you only have 30 days to file a fraud claim. If it takes you longer than 30 days to prove fraud, you will not get your money back.
Tell your mother to stop using her atm card to pay for transactions, where she is required to enter a pin. Have her use her ATM card, as a credit instead, so no pin will have to be entered instead.
She needs to change her ATM card again, this time she needs to be careful where she uses it. If she needs cash have her go to the bank, but be careful there too, because skimming was even found to be done at banks.