Sorry, anon, I'm with Happy on this one.
I think it's in the best interest of the bank to do absolutely everything possible for it's customer.
If the gym has no authorization on file, then is it possible that they never had one to begin with? Is it possible that they transposed an account number and the true person never said anything as they have gotten a 'free' gym membership? That same person also could quit their gym membership just as easily because they don't have to worry about fees and charges, correct?
Whether the gym needs to make her whole completely, I don't know (although there is a good argument to do so- I mean, if you are continuing to auto deduct someone, wouldn't you still want the autho on file? Isn't that good business practice or better yet REASONABLE?)
I think you have to do what you can. Period. To not do anything is a disservice to the customer.
_________________________
The artist formerly known as 'Swedish Chef'