Refund initiation notification sent to customer
Why it matters
A customer who requests a refund and receives no acknowledgment has no idea whether the request was received, is being processed, or was silently rejected. Under GDPR Art. 12, data subjects must receive transparent communication about actions taken on their financial data. Without a refund initiation email, customers default to disputing the charge with their bank — a chargeback that costs you the dispute fee on top of the refund itself. The notification is also the correct moment to set expectations: '5–10 business days' in an email beats a support ticket asking the same question.
Severity rationale
Low because missing refund notifications increase chargeback rates and support contact volume without directly corrupting order data or enabling unauthorized access.
Remediation
Add a refund initiation email to the refund handler at app/api/orders/[id]/refund/route.ts immediately after the refund record is created.
// After db.refund.create() in app/api/orders/[id]/refund/route.ts:
await sendRefundInitiatedEmail({
to: order.user.email,
orderNumber: order.id,
refundAmount: amount,
currency: 'USD',
processingDays: '5-10 business days',
refundId: providerRefund.id,
})
If Stripe is configured to send its own refund receipts, document that decision in lib/email/order-emails.ts as a comment rather than silently relying on it — provider defaults can change.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Order Management Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- iso-25010:2011 · reliability — Reliability — fault tolerance / notification delivery
- gdpr · Art. 12 — Transparent information and communication on personal data processing (refund status)
Taxons
History
- 2026-04-18·v1.0.0·Initial import from ecommerce-order-management·automated