I mean you can't just not validate the payment method when your sole purpose is to act as a payments facilitator so you can skim money off the top and then lump that onto the freelancer when you fail to catch fraud. I consider this a fraud issue between Upwork and Robin because they never validated Robin was the correct card holder. Whether manual hours or tracked through Upwork, Upwork has a duty to validate that the person paying isn't a fraudster and they failed to do that over a multi year period. That strikes me as strictly negligence by Upwork and the burden shouldn't be on the contractor.