If someone were to access your bank account and take money without permission, the bank would require you sign an affidavit so that they can prosecute before the bank would refund the money. It seems similar here. If the OP thinks this is fraud, then the OP has to allow Marriott to recoup its losses. If the OP doesn't think it was fraud, then the OP will have to absorb the loss.

While the hotel was definitely wrong here, the hotel was only wrong as far as it did not have policies or procedures that would keep this fraud from happening. It still took the BIL to commit the fraud, so Marriott should be able to go after him for any losses incurred.