Unathorised Payment

[broadex]

I hired someone on Fiverr to improve my site and he selected a few demo Shopify themes for me to look at. I ended up not going with themes, but as he was deleting demo themes on the site, he said he clicked “buy” on one of the themes by mistake. I was shocked when I got a notification that I had ordered a $250 theme, and I immediately contacted Shopify about the mistake and theme was not downloaded. But it has been a week since the event, and Shopify do not seem to want to refund me. I still don’t understand how if you give someone access to shopify site can order something without your card details or notification to the owner – that sounds like a serious security issue? Any idea how to proceed before I involve my bank re this unauthorized payment?