I thought I had set up security features that would make using my credit card impossible - but he seems to have bypassed them ...