Yes, she can sue you for any costs or charges you caused her to incur, and could also press charges. To recover money in a civil suit, she would simply have to prove that you were at least negligent, or careless, in using her information, which is very likely. For charges to be initially filed against you, there would have to be reason to think that it is reasonably likely that you deliberately used her information--which may be relatively easy to show, since if your info "popped up," you had a chance to view and double check it; if you let the order go through with the wrong information, that suggests you did it deliberately. To be convicted of a crime, the authorities would have to show "beyond a reasonable doubt" that you deliberately used her account--which is clearly much more difficult, but not impossible, since again, you had the chance to correct the orer, but let the wrong information be used. Therefore, yes: legal action could be taken againt you.