I'd contact both if I was you - your CC company first to register the fact that there seems to be an unauthorised transaction and then get onto the retailer to investigate why. Any chance it's an online transaction where a form submit button was inadvertently clicked twice!?