If his IP matches with his email him something like this.
Dear Mr. X
Thank for bringing this to our attention. Credit Card fraud is a serious issue. We have sent our access logs to the proper authorities. We have the utmost confidence that the perpetrator will be caught.
Our access logs are state of the art. We have the IP address of the perpetrator. Therefore it is only a matter of time until the authorities catch them.
You can rest easy. The perpetrator will probably either spend 6 months in jail or fined $250,000.
Should cause him some sleepless nights.
