Hertz only met their obligations towards the credit card company. They didn't meet their obligations towards the victim of their unauthorized transaction.

That obligation goes beyond refunding the money taken without permission. It includes the costs of getting that money back to the victim of their error.