Im wondering how long will a bank allow you to make a police report after you report to the bank that your info has been stolen.

My boyfriend realized about 10 days ago that his business checking account had unauthorized charges which cause his accoutn to be over drawn almost $3000. He reported to the bank and closed the acct. He has not filed a police report and that was over a week ago. Im starting to wonder if he might suspect a former girlfriend of the act. How long will a bank give you to report the incident to the police and if he waits too long will the bank hold him liable? Also: his checks nor his bankcard were actually stolen. Someone has the checkcard # and made purchases via phone for game tickets, floral arrangements etc. How can someone make purchases like this via phone without having to give verifying info.?