And unless the bank wants to breach privacy legislation they are not going to have a single conversation with the OP or her DH about the bank account (unless that is the MIL has been committed somehow and her son has power of attorney or whatever it's called nowdays).
I'm not saying the fellow isn't shady. Just that at the moment the OP has absolutely nothing on him and if she kicks up too much of a fuss without more substantial evidence she's only going to make herself look like someone who needs help.
It's up to the MIL to manage her own life. Unless she is mentally incapable of doing so, which is a whole other kettle of fish.