Hi there Michael 
I’m really sorry to hear about this. If you don’t mind, I’d like to look into what’s happened, so I’ll send you a DM to get some details.
For the record, we absolutely do have a system in place to deal with this - We can block any merchant from taking a CPA from our support back-end. Alternatively, one quick way of stopping it is to simply replace your card in the app, as the merchant then won’t have the correct details.