sounds to me like the 'friend' is probably non existant & they have gotten an account/card in a false name or the name of a person who is deceased (happens alot) They maybe taken you're being reasonable with them as that you're a push over & they're going to get away with it.

I would play hardball with them & tell them you've been advised you should call the police because it sounds like you have both been the victim of online fraud. (play a little bit dumb, not blaming them & you've been advised sounds less 'attacking' than you thinking of the idea yourself), hopefully should sort them out quick smart.