Sounds to me as though OP needs to have a chat with his "friend" the AU card holder. If that card was used for the GA transaction, it is OP's 100% responsibility and he and his "friend" can have a chat about this.
How OP explains this to CIti so CIti does not have him flagged as a fraudster is beyond me. The truth might be helpful.