Made an online order, they took the money and then CANCELLED the order!!!

My fiance decided to order me an iPhone for my birthday and since he was a new customer he had some promotions. He made the order online, they took the money and not long after he recieved a confirmation email with a tracking number and a delivery date. The VERY NEXT DAY, he recieved an email that said ATT cancelled the order because they couldn't verify that the order came from him, but not to worry because any holds on our card would be released in 3 business days! Almost 1 week later, STILL NO REFUND! STILL NO PHONE! So he calls and gives the gentleman on the phone the order confirmation number and all other required information. This guy says in order for us to get our refund he has to give us a release number and HE HAD TO CALL OUR BANK AND GIVE IT TO THEM FOR THE RELEASE OF FUNDS!!!! How the (Edited per community guidelines) do yall take the money BEFORE verifying who the order actually came from, and WHY is it our responsibility to call our bank with this information when it wasn't our mistake that took the money out to start with! My fiance even asked if they could just reissue the phone since they had confirmation it was him and they said NO BECAUSE THEY DIDNT HAVE THE ABILITY TO DO THAT!!!! Do you or do you not work for ATT? Did we or did we not order the phone from ATT?