I worked in a bank and a credit union in the United States, and I am sorry I am just seeing this now. The biggest reason from what I can read as to why they denied your claim to begin with is that Amazon either provided proof that you indeed made the transaction, OR that the financial institution accessed that the online merchant was responsible and therefore they should credit you. Claims can be denied from people who used Paypal for example and such because it can be determined that the entity was responsible for your information being taken or that there service provided could be to blame, and that excuses the financial institution from fault. Financial institutions look to protect themselves.
Banks are businesses looking to profit, something to remember in our capitalist society. Credit Unions are non-profits and are generally better, but if their board (the people who make decisions) are trying to run the credit union like a bank, sometimes they run the credit union the same way anyway. Small banks and credit unions are usually better though, but do some research on them before joining is my suggestion. Look to see how they are within their community and what people have to say about them.
If you ever have an issue like this again, please feel free to reach out by direct message. I am sure I can help, and just to be frank, I would explain what you should do and ask you not give me sensitive information. It's all about the information you present them and how, but "bothering them" also does show that your "issue" wasn't resolved another way. Also, fraud has been INSANELY high since COVID hit, so banks are trying not to give stuff back if they don't have to...
Police reports almost never go anywhere I am afraid, as most of fraud cases are overseas and it is a terrible waste of resources to try and convict anyone for them. Police in the United States already have their hands full with domestic stuff. In the United States, it's difficult to even get someone convicted if they are out of your state. That doesn't mean you should not do a report, it is an important part of the process and should be done and sent to the financial institution so they can keep it on file.
Another thing to take note of, is that "security" for debit cards is truly theatrical. You trust the waiter with your card number the moment they walk away, the sites you buy things from the moment you put your number in, etc. Apple Pay, Samsung Pay, and the like are more secure, as they give merchants alternate credit card numbers only good for that purchase. It's also contact-less. If the merchant's information is compromised, the hacker doesn't have your financial information.
Hope this helps somewhat in the future...