WTF are they doing???? Of COURSE they need to give her a new card, with a NEW number. Otherwise how the hell are they planning to stop them using it again. What a pile of stinky do-dah!!!
Their rules state:
THEFT, LOSS OR MISUSE OF CREDIT CARD
If your credit card is lost, stolen or misused by someone without your permission, you may have to pay up to £0 of any loss to Halifax plc. If it is misused with your permission you will probably be liable for ALL losses. You will not be liable to Halifax plc for losses which take place after you have told Halifax plc about the theft, etc as long as you confirm this in writing within seven days.
Which means they MUST give the money back.