If you are certain that he has lied about claims in the past, that's a relevant fact for consideration.
He seems to have lied about at least one of the charges in this case (or had a memory lapse that was cleared up when he was asked about it). That's another relevant fact for consideration.
He reports that he was ashamed. But why would he be ashamed to report the transactions if he didn't do them? That's another relevant fact for consideration.
Merchant has not only name, phone #, and address, but also email address. Did the merchant send any kind of confirmations or have any interaction with the member via phone, text, or email? If so, that would be additional evidence.
The burden of proof is on the bank, but unless he files a lawsuit, you have to make a determination as to when that burden has been met. Is the evidence you have that he did the transactions stronger than the evidence that he did not (which at this point consists solely of his own statement)?
_________________________
Nobody's perfect, not even a perfect stranger.