My Boyfriend Had A Car Salesperson Steal His Banking Information. What Can He Do?

My boyfriend went to a car dealership on Friday and bought a car. Friday night, he noticed there were attempted charges on his card for a betting website. He called his bank and cancelled the card, and the bank told him that the address the transaction took place from is really close to the dealership. I looked up the address and a person who lives there popped up as a result. I asked my boyfriend who sold him the car and the name matched. My boyfriend has contacted to police and they are doing an investigation. Can my boyfriend take legal action against the dealership for this? What are his options?