After multiple complaints and ~30 hours, I received 90% of the refund. It took another 18 hours and more bitching to get the remaining money back.
NOW, I notice that I can’t #DELETEUBER. I can’t remove the credit card and I can’t delete my account with them. If I am not mistaken, that is a financial industry regulated requirement, that users must be in control of removing credit card details if they so choose.
Speaking as a software engineer, with 33 years of experience, Uber’s inability to detect the fraud here is unforgivable, AND says volumes about their Security mindset. I bet that all credit card details at Uber are wide open for exploits by criminals. Maybe already happened, who knows. Uber probably would not even notice that they leak credit card details. Disgrace!