The mercant can sue the unauthorized user for the money who whatever was sold to him/her (if you "buy" something or otherwise take it, you have to pay for it); however, that is likely the only recourse, since the credit card's authorized user cannot be made to pay for something charged by an unauthorized user, and the credit card company only has to pay for authorized charges.