Try
http://tools.whois.net/whoisbyip/Thing is, ISPs are allocated a block of IP addresses. Most users will have dynamic IP addresses, meaning they're assigned one of the IP addresses out of that block every time they log in (hence the word "dynamic".) Even if the user has a fixed IP address, running a WHOIS will probably just go back to the ISP anyway.
So that would make it hard for you to do, but not hard for the ISP. If they're given the time of access, the credit card company's URL, and the IP address, they can tell which of their customers was assigned that IP address. I dunno what the current state of affairs is, but I'd hope they wouldn't give up that info without a subpeona, which means the police would be the ones to follow through on it. The credit card company should be used to liaising with the police on this sort of stuff, actually... sounds odd to me that they'd be giving you the info and implying that you need to do the legwork yourself. But I don't know the protocol on this stuff, so it may be standard procedure for them to expect you to deal with it.
Hope this helps... good luck!
(Edit to say I'm not a tech wizard; this is just general info I've gleaned over the years and it may well be out of date.) :)