Home computers in general tend to be as secure as the knowledge of the owner allows it. So a well-experienced owner/user of a home PC with plenty of security knowledge has a pretty well-fortified fortress... It sounds as if your CEO just has a sandcastle and someone stepped on it.

However, the good advise has already been given. Call the credit card company and/or the site owner. Furthermore, update the virusdefinitions on this computer and run a full virusscan to remove the 16 viruses and 12 worms this CEO probably has on his computer.