Investigators say the Santa Cruz surfer’s girlfriend let the attackers into his home, where they beat and tortured him for his bank card PINs, then faked a car theft to cover it up.