I don't normally thumbs up posts with such harsh language, but in this case I feel it's entirely justified.

I was once the victim of identity theft. These guys opened bank accounts in my name, credit cards, applied for loans, stole money, you name it. It was a horrible ordeal that took months to straighten out. Trust me, it's not something that I would wish even on my worst enemy. And as we've seen here, it's not just the person whose identity is stolen that's affected. Every institution and business that these guys ripped off using my identity got f***ed as well.

Thieves suck, but unfortunately they are out there in mass numbers and getting more and more clever every day. All you can do is try to be extra vigilant when it comes to protecting your information. Use strong and unique passwords for everything, and try to use some form of two factor authentication whenever possible. Also, make sure to monitor your credit reports like a hawk. In fact, I'd recommend putting a security freeze on all your credit reports. There's really no reason not to, and you can always temporarily lift the freeze if you need to apply for credit or a loan.

I doubt it was the thieves that initiated the backcharge. Most likely what happened is the person whose identity was stolen finally realized it and disputed the charge.

Once the person's identity has been stolen, changing the billing address is a piece of cake.

This is where it gets complicated. I'm no expert in these matters, but I believe if the transaction was done in person with a magnetic strip or chip, then the issuer of the card takes the hit. If the card isn't present, then the merchant takes the hit. I'm assuming this transaction was done over the phone.

Yep. In the US, the consumer has pretty much complete protection against all fraudulent charges.