The "bank" is simply the issuer of the card in this case. They are being ZERO help. Assuming the charge goes through (instead of just held, which is no practical difference for him at the moment since he can't use those funds either way) he can then dispute it. At this point, the "hold" may just sit there for either 2 or 3 weeks (can't remember what she said) and then drop off.
It is odd they'd have put a hold and not a charge.
He now can not use any of it as they are sending him yet a THIRD card since the other card was compromised. Which made absolutely no sense since it was charged on the first card, which had already been cancelled and not the second card (which as a different number on it).
Who knows.
Why not get him a credit card with a secured line of credit? He cannot spend more than the amount you secure it with. Have him pay it off each month. Builds a good habit, builds credit, and is much more protected from fraud than debit cards.