Also, they told me not to speak to my "employer." I've been getting messages from him all day, and have simply ignored them.
And also, I called the San Diego Police to report the incident; the automated phone system said, "Credit card or bank fraud must be handled with the company or bank of the account holder." They also mentioned going to ic3.gov for filing an internet crime complaint. That said, my bank wants the name of a detective investigating the case, as well as a case number, as part of their records. What should I do?