I have not submitted to the NVC but what it really comes down to if the income you can prove which should be on your tax returns. I have all my tax returns. I'm just using the letter so that they can see where the money is coming from and its not in question.
If you paid with a debit card call your bank and tell them there is a fraudulent charge on your account. If you did it with an actual credit card call the company and tell them that this is a scam and you are scared they will compromise your identity and have them remove the charge and issue you a new card immediately. Then visit WWW.USCIS.GOV. It's the only valid website and you should not be charge for any forms, plus you're suppose to mail your application fee made out to the Department of Homeland Security.
Hope you get your money back :)