It seems you think Apple is involved in this transaction and giving too much credit to what Apple Pay actually does. For a quick explanation, when you add a card to your Wallet it is the bank of that card that approves it to be added and they will then send a unique token to be used for purchases, so the retailer does not know what your actual card numbers are, that would leave you vulnerable to a data breach. It really does nothing more than facilitating a secure transaction between the merchant and your bank using a unique token your bank gives to you, so the merchant does not know the credit card number.
After you authorize a transaction, you send the token to the merchant that the bank of the card gave to you. All transactions proceed between the merchant and the bank of the card like they always had before. Apple is not involved in the transaction and does not approve the transaction. Like all disputes, you do that with the bank of the issued card if you are unable to resolve the matter with the merchant.
When a bank cancels your card and issues you a new one, subscriptions from the previous card are transferred to the new card because it is their bank that is using a Credit Card Updater program to transfer those subscription from any participating merchant. Your bank is fully aware of what a Credit Card Updater is and they are doing that without any involvement by Apple. They need to do the next step when disputing a transaction, and that is to block it by revoking the token they gave to you to give to the merchant. It does not sound like Citi is being very honest with you if that is what they said. To get a bit more information about that, you can read here and there is all kinds of information available to you by searching:
https://stripe.com/resources/more/what-is-a-card-account-updater-what-businesses-need-to-know
Apple does provide a method to revoke the token, but that is not a substitute for contacting the merchant and the bank like you would in all other cases. Revoking a token through your Wallet is only a voluntary program to notify the merchant and as you can see in the Support Article that was previously provided, it may not be as effective as contacting the merchant or formally disputing the transaction with the bank of the issued card.
What do you do? You escalate the matter with Citi and get your money back along with cancelling any future charges. All banks are regulated by the Government and operate under specific rules. If you are not getting the results you expect, you file a complaint with the CFPB. If is a Government agency responsible for resolving disputes involving the Credit Card companies/banks and their website says in most cases you will get a response in 15 days. They are not treating you fairly and not doing their job.
https://www.consumerfinance.gov/complaint/
