Dad believes it’s credit card fraud, but I think it’s my friend

I have a doordash account that has my dad’s card on it (he used to order food with my account), that I haven’t used in a while since I went to college, but all of a sudden, a bunch of charges started showing up on his card from there. I haven’t been using doordash, & my dad filed a fraud case with his bank company against those charges (around $300). I decided to do some of my own sleuthing, & I found that a lot of the food was going to my college address, but I hadn’t been ordering any. This is where I realized my stupidity- a few weeks ago, I let one of my roommates log into my account to order something, and I believe he has continued using my account to order more food. I’ll obviously talk to him and sort it out, but I’m not sure how the investigation will go? Is it likely we’ll get our money back from the card company, and will they raise some sort of criminal investigation against the residents of our house? (Me, my roommates) because I’m guessing doordash will provide the bank company with the order address. I would like for my dad to get his money back because the charges are unauthorized on his part, but I don’t want my roommate to get arrested either.