You should report. All those affected by this type of operations should join and report. It is the only way to enforce your rights. In no way are you responsible, you are only the victim, because you are the only one who is harmed, without even having participated in the transaction. Those responsible can only be those who have intervened in the operation: the cardholder, the authorization center or CGT.
The cardholder is responsible for their custody and is required to report their theft, loss or fraudulent use. You would be surprised to know how many of the allegedly fraudulent operations have actually been done by the cardholder, or someone close to him. Is there a police report by the cardholder? Were the operations done before, or after communicating the incident to the financial entity?
If the payment means alert center already has knowledge, it blocks the card and no operations can be made with it, (except for off operations, without connection to the authorization center, and with a small amount limit). Was the card locked? Who authorized that operation? If there is authorization, why does the operation go back? And if there is none, why was the sale made?
The banks have warning systems that warn of risky situations: large purchases, large amounts, in suspicious stores (jewelry stores, art galleries ...), high-end objects ... They have limited amounts for off-road operations and fraudulent use insurance. Why does CGT not have a control system for operations like this? Why not take steps to solve this and other serious problems you have?
This situation is repeated too much and is very strange in itself, because those who dedicate themselves to clone cards, do so to obtain a benefit. And I don't see what benefit they get here. The thief may not be far from here. Anyway, electronic transactions leave a mark and this individual has left many, which the authorities can track. So, feel free to report.