As you have detected and fixed this fraud perpetrated by someone you know, are you going to report that person to the police in your jurisdiction, or the jurisdiction where the alleged fraudster resides?  This may seem like a rhetorical question as I bet your site is unlicensed and therefore you would be complaining about fraud at an illegal business, but it does raise the question of what can be done about thieves that backdoor the site and seemingly can escape without any risk of penalty?