When she asked you to wait, she's trying to play both sides of this: "I have an error, but I don't want you to take it over." My question/statement would have been "are you reporting this or not? If so, we're going to capture the debit card to stop future transactions and we're going to go after them. Once you turn it over to us, you're not pressing charges. We are."
If she decided she didn't want to pursue this at the time of initial reporting, it would have been best to document what happened and how she wasn't pursuing it as an error reported to the bank. I would have had her sign it too. Unfortunately, the technical answer is you have to comply with Reg E. I don't think you can not comply with a federal requirement because she told you to wait.
So what do you do now? Document what happened, issue provisional credit and treat it like any other error resolution. The good news is you know who the suspects are. Go after them.
Truthfully, I might tell her to go jump in a lake and take a Reg E violation if it's ever discovered by an examiner - but I'm not advising you to do that.