I’m sure they could.
It’s likely a matter of them wanting to.
—————Article-———————
“Banks said Carnival told her that it believes the IP address of the person who canceled was in British Columbia but it was unable to get an identity of the fraudster.”