Indeed contact the police as well. The ‘client’ is quite simply a thief.
Using someone else’s credit card without permission to obtain thousands of dollars of services is criminal fraud. Ultimately he should be the one forced to make restitution under court order.