Refunds that move fast without moving money by accident

Refund automation is the classic case where speed and safety pull hardest against each other. The interesting question is not how quickly a refund clears, but which refunds a machine is allowed to clear at all.

Book Enterprise DemoSee pricing

The situation

A direct-to-consumer brand ships 900 orders a day across a website, two marketplaces, and WhatsApp. Returns arrive through all four channels in different formats, and the refund itself is an irreversible movement of money. Teams automate the easy 80% and then discover the automation also handled a case it should not have — usually a high-value order, a serial returner, or a duplicate request that refunded twice.

  • Four channels, four formats

    A return request might be a webhook, a marketplace CSV, an email, or a WhatsApp photo of a damaged item. Someone rekeys all of it into the order system, and the rekeying is where the wrong order id gets attached to the right refund.

  • The duplicate that refunds twice

    A customer chases the same return on two channels. Both tickets progress, both reach a refund step, and the second one succeeds because nothing checks whether money already moved for that order line.

  • One payment token with full refund rights

    The gateway credential that issues a ₹400 refund is usually the same one that could issue ₹4,00,000. Nothing about the automation's access reflects the value band it was built to handle.

  • Chargeback evidence assembled by hand

    When a customer disputes with their bank, you have 7 days to produce the order, the delivery proof, the return condition, and the refund record. Today that is four screenshots from four systems, pasted into a form.

The workflow

Every step names the control that applies to it. The steps marked Human are the points where the workflow stops and waits for a person — by design, not because the automation is incomplete.

Shopify → AI → Approval → Razorpay

  1. 01 / 07System

    Normalise return requests from every channel

    Webhooks, marketplace exports, and support tickets are mapped to one return record keyed on order line, not order. A single order with three items produces three independently resolvable lines, which is what stops a partial return from refunding the whole basket.

    Keyed on order line, idempotent on external id

  2. 02 / 07System

    Idempotency and duplicate check

    Before anything else, the workflow asks whether money has already moved for this order line. A prior settled refund halts the run and links to the existing record, so the same return arriving twice cannot pay out twice.

    Settled-refund check precedes every payout path

  3. 03 / 07System

    AI classifies reason and condition

    The model reads the customer's description and the return photographs to propose a category — damaged in transit, wrong item, sizing, changed mind — because that category decides who pays the shipping. It proposes; it never selects the refund amount.

    Model output is a proposal, not an authorisation

  4. 04 / 07System

    Value banding

    Refunds under ₹2,000 on a first-time return with delivery confirmed proceed automatically. Everything else — higher value, a customer with three returns this quarter, a missing delivery scan, or a mismatch between the stated and detected condition — is routed to a person.

    Explicit auto-clear band, everything outside it escalates

  5. 05 / 07Human

    Support lead approves out-of-band refunds

    The reviewer sees the order, the delivery scan, the return photographs, the model's proposed category with its confidence, and the customer's return history on one screen. Approval is recorded against the individual order line, not the batch.

    Per-line approval, full evidence on one screen

  6. 06 / 07System

    Scoped refund execution

    Calls the payment gateway with a credential whose refund ceiling matches the automation's band. A request above that ceiling fails at the gateway rather than relying on the workflow to have decided correctly — two independent limits, not one.

    Gateway credential capped below the approval threshold

  7. 07 / 07System

    Assemble the dispute packet

    Writes order, delivery scan, return condition, category decision, approver, and settlement reference into one immutable record per line. When a chargeback arrives, the evidence is a single export rather than a scavenger hunt.

    Immutable per-line record, exportable as evidence

Controls

Step-level controls stop a single action. These apply to the workflow as a whole, which is what makes the difference between a logic error and an incident.

  • Two independent ceilings on every payout

    The workflow decides what to approve and the gateway credential decides what is possible. A bug in the first cannot exceed the second, which is the difference between a logic error and a financial incident.

  • Every payout path is idempotent

    Refunds are keyed on the external return id, so a retried webhook, a replayed run, and a duplicate ticket all resolve to the same settlement. Retry safety is a property of the workflow, not a convention the team remembers.

  • The model never sees payment details

    Classification receives the description, the photographs, and the order line. Card details, UPI handles, and bank references are not in the prompt and are merged only at settlement, inside the gateway call.

  • Return history is a control, not a report

    A customer's prior return count is read at decision time and forces review past a threshold. The pattern that a human would notice on the third return is enforced on the third return, every time.

The shape of the change

Each row states what the controls make possible or impossible, rather than a measured saving. The change is structural: the same work, with the risky path closed off.

  • Duplicate payouts on the same order line

    WasCaught during reconciliation

    Blocked before the gateway call

  • Assembling one chargeback packet

    WasCollected by hand from several systems

    One export, itself logged

  • Maximum a bug could refund

    WasThe gateway limit

    The band ceiling

Other workflows

The same controls apply across every use case. Only the steps and the thresholds change.