If you're not using Bitcoin-QT, it might just be the transaction confirming.
It would really help if you posted the Transaction ID. There are no security worries on doing so.
I doubt this person is running a desktop wallet. Seems that the processs of finding, downloading, installing bitcoin-qt, waiting for blockchain to sync would lead to the OP knowing many basic facts about bitcoin which this person doesn't seem to know about (like, for example, what's a transaction hash). My guess is that this person gave CC info to a website and is now having buyer's remorse about that decision or something like that.