In real life I build credit card processing systems - sometimes I get paid for it too : )

I have to say it's trivially simple to screw up, you never mean to do it, but you do - corporate drones want you to have a system fully built and running yesterday, screw testing, for whatever their latest cute little pet project happens to be. CC companies want you to comply with PCI-DSS, nobody wants to write policies, external scanning fails, your hosting provider drags their feet on security, and a myriad of other time sinks that can trip you up along the way.

More than once I've forgotten to switch operating flags over to production mode. The other big problem is that the store administrators regularly enter incorrect taxation values, wrong prices, forget to subtract any discounts or promos, and on and on.

No excuse that they haven't contacted you though, that's just plain old poor customer service.

Good luck, I'd do what others have said and talk to Visa / MasterCard / whoever and do a chargeback. It's a painless process for all involved with the exception being the seller who is then out of pocket. (Maybe rightfully so in this case)