As a business accepting credit card payments, we attempted to be good citizens at first. We would try to notify the credit card company or the banks when an obviously fraudulent transaction came in and that kind of thing. We even tried calling the police at one point with IP logs and so on.

Nobody gave a shit.

We asked our credit card processor, Stripe, what to do about fraudulent transactions. They told us that they had no way of notifying a bank about that kind of thing and to just refund it.

So now our policy is just to refund fraud and forget about it. It's a position we were forced in to. This means that the person whose credit card was stolen will continue to be abused and there really isn't anything we can do about it.