The victim should call her local police dept and file a report.

Obviously she should immediately cancel that card...

And I agree with the "fraud alert" notice on your site. Good idea.