You can't make a deposit into someone else's bank account.
Make sure you clarify what happened. Did the deposit show up, and then disappeared? Or was other money separately removed?
What you need to know is that an ACH direct deposit is a complicated process that generally take 3 business days to settle. The first step is the sending bank (in this case, the IRS) sends an "advice" to the receiving bank informing them of incoming funds. Then there are several intermediate steps, and the last step is the sending bank issues final confirmation of sending the money and the receiving bank confirms final receipt (final settlement).
Some banks make funds available on the "advice" even though the transaction is not actually settled. So if the bank got advice of a deposit and made funds available, but the transaction never settled because the IRS learned that the account holder's name and SSN are different from the taxpayer, then the debit card bank will take back the money (because it was never really there). In this case, your son spent his refund before it settled, the bank took it back, and there is nothing he can do. The girlfriend should receive a check in 4 weeks, and she can pay your son back.
Now, it's also possible that the debit card bank made a mistake, if the deposit never settled AND they sent extra funds back to the IRS. In that case, complain to the debit card bank. The IRS does not withdraw funds. (The IRS might fail to settle a deposit after the advice, but that's just the IRS not sending the funds, its not the same as a withdrawal.)
