Since we don't have any specific details - as with any suspicious transaction - one starts by contacting their bank or credit card processor - each institution or service has their own process in place for initiating a claim - some want you to contact their Customer Service while others have an online form. For example, if this was a Square Debit Card - see this.
