I had the same thing happen during the first week of the year. The ATM card we use is from Schwab brokerage.

Here's the scenario:

A withdrawal made on New Year's eve suddenly appeared twice on the the internet activity page.
Oddly, both had the same transaction number. However, one was an ATM withdrawal and the other showed as POS (point of sale) transaction.
It being the holiday I couldn't get in touch with Schwab until the following Monday.
When I spoke with them and their fraud/forensic department they were unaware of the issue but immediacy refunded the second (POS) transaction
I told them I needed to make another withdrawal and they told me to go ahead and they would monitor.
On Tuesday the same thing happened so I called again
At that time they told me that it was happening to all ATM transactions in the Caribbean and South America and was being investigated.
All ATM and CC purchases in the Carribbean and South America are processed at a facility in Brazil..
By Friday the problem had been solved and has not occurred again. They blamed it on a sofware glitch.

Interesting conjecture on my part:

1. I fund the Jamaica card on an "as needed" basis and it is not tied to any other source of funds and I transfer the funds by hand on the 'Net
2. In the interim I only have 10 bucks or so in that account. This can be done is seconds by way of the internet.
3. The first double withdrawal took the balance down to a negative number which is impossible without a secondary backup account
4. The "software glitch" explanation make no sense. I've been using this system for several years with no problem.
5. COMPUTER CODE CANNOT REWRITE ITSELF !
6. Possibly a code error due to the change in year? Remeber Y2K?
7. "All now" There has never been an explanation of these events
8. I think it was a hack at the processing facility but it's hard to figure who benefited.

That's what I know. Everything is back to normal

Cap