It's very common, sad to say. In fairness to the banks, it is difficult to track down where the actual scimming took place, it could have been at an ATM they own, one owned by another bank or at a shop with a cashier seeing and remembering your PIN.
Your brother should ask that is has been reported to the banks internal fraud people and should follows up his calls with something in writing. He also should ask for the bank to cancel his card and issue him with a new one.
Banks are usually happy to refund unless they have a question mark as to whether or not the person facilitated the fraud, either through carelessness or by working in collusion with the frauster