The first step is to call the credit card company that’s supposedly been used, and use the phone number on the back of it, no other number. If a fraudulent transaction is noticed by the customer service rep, they can reverse the transaction. Worry about the emails later.