Actually, you gave the customer $23.97 back because of Reg E 1005.6(b)(3), not Mastercard Zero Liability.
As the name implies, had you provided Zero Liability protection, you would have reimbursed the customer for all four transactions making their liability Zero. However, since the customer did not exercise reasonable care in safeguarding their card from loss, you did not provide Zero Liability protection.
Instead, you looked at 1005.6(b)(3) which makes the customer liable for all the charges that occurred more than 60 days from the date of the first unauthorized charge. You cannot retroactively apply unlimited liability to transaction that occurred between 2/2/24 and 60 days after the February statement. Since the customer is likely still in possession of their card as I assume these are recurring card not present transactions, 1005.6(b)(1) and (2) would not apply to this scenario. 1005.6(b)(3) makes the bank liable for the early charges, and the customer liable for later charges. Based on this, I conclude that this claim was handled properly.
_________________________
Sola Gratia, Sola Fides, Sola Scriptura, Solus Christus, Soli Deo Gloria!
www.tcaregs.com