With theft, somebody ends up without an Xbox. Theft is wrong. This is mere breach of contract, whether it's wrong depends on the contract.
What?! It is definitely credit card fraud, and a criminal enterprise, and by any definition it is wrong. I cannot imagine a jurisdiction where this is a “mere breach of contract”.
You’ll have to clarify who the counterparties are to this contract and where the person whose credit card was stolen fits into it.