Sorry for being late with my input on this. I have had very good results by having the customer call iTunes and report the fraud. They refund within days, usually within the 10 day Reg E timeframe for provisional credit. I still do my disclosures, letters, etc... under Reg E just to be prepared in case it doesn't work out.
I found that to be easier and cheaper than eating charges that are, for the most part, below the MasterCard dispute limit.
The same is true of most big companies, such as Google Wallet, Steam Games, etc.