You should ask a lawyer. I’m afraid that in some countries you’re responsible for verying that the information given is true and, if something like this happens, you’d be responsible and the bank will not return the cash. Verification for an online business is a bit harder because you can’t match the signature on the card with a real person, or ask any other form of ID.
Some companies do receive the cash back because they have insurances for these cases.
But the only person that can only help you now is a lawyer.