A friend had his data stolen in Target. Thieves charged $3,000 before he realized it. He called the company, which sent a new card. But they have to post the charges and he has to call each time to have them removed. They said that was the only way to do it.
That happened to me. Luckily I had the alerts put on my account that notified me. However, your friend is correct. You have to wait until the charges move from pending to posted.