Agreed. That's likely credit card fraud. Someone should be suing Robin. If the CC owner had no knowledge of the transactions then he/she is not liable. If he/she did (2 years ago) authorize Robin to use it, that's different. In either case, Upwork should absorb that loss. Bad PR costs more.