回複：謝謝老貓，看來還不得不應付此事！

You don't have to deal with the merchant at all. All you need to do is to inform your credit card issuer that you didn't make the transaction. The issuer(Bank) may send you some forms to fill. But no matter what, it's not your liability to pay the fraudulent transaction. It's either Mecrhant's or Issuer's liabilty, depending on the types of transactions.