I don’t think this is your fault at all. I suggest looking for a paralegal or a lawyer in the country where Robin lives and the bank branch is; and paying them for 1 hour of legal advice. The way I see it, Robin either used someone’s credit card with their permission, or he scammed that person by using their card. The chances are, it’s the 1st scenario, maybe he’s divorcing his wife and she decided to get her money back after allowing him to use his card. So, first and foremost, legally this should be Robin’s fault and he should be charged with fraud. But as far as Upwork is concerned, THEY accepted his card despite the mismatch between Robin’s (client’s) name and the name on the card. It’s totally their responsibility.