Credit Card Stolen

We recently hosted a private event in Ontario Canada, where we knew everyone attending-
someone attending stole an organizers credit card
and bought McDonald’s + went on a liquidation store shopping spree and we’d like to know who exactly it was for obvious reasons-

Issue is- we know we won’t be able to the footage from McDonald’s that they purchased at 6:25am,
but the liquidation store might be somewhere we could get the footage- but the liquidation store where the bank cornered the transaction was made is over an hour away from the McDonald’s they were at- at 6:20am,
and the liquidation store owner says they weren’t even open at the time of purchase (6:40am)
what’s going on here? How is it possible the bank confirmed a transaction was made for this exact liquidation store but in a city an hour away from where the actual liquidation store is and the transactions only show a 25 minute difference?