someone has used my credit card for buying icloud subscriptions without my permission

a month ago , my mother got the summary of her credit card , only this time there was a small amount that we didnt knew what it was . a few days later I got an e-mail that said we had paid a subscription of 1TB on iCloud , this was obviously a trap e-mail , as it was sent to many users completely random . but despite that, they had the details of my moms credit card ... and before any attempt to cancel the subscription we always ended up redirected to a page full of virus.
we need help,

what we should do?