this all sounds horrifying, but the most logical step would be to get Robin involved, and get him to refund the money to the other persin’s account. I mean, it’s him, who was basically stealing. It’s not your responsibility.

And Upwork should have checked if the card was in his name, so they shluld take a little more responsibility here.