The bottom line is that no matter what records you keep, no matter how many emails from customers you get, no matter how many times you talk to them on the phone, they will win if it goes to chargeback because it is an electronic transaction devoid of the customer signature.

The credit card system and banking system are still very much set up in favor of the consumer and very much against the merchant.

We have a policy that we try to discourage the chargeback and we use several of the tactics included in this post, but we always immediately issue a refund and blacklist the card and person as soon as anyone starts talking about unauthorized charges, fraud, or potential chargebacks.

All it takes is the customer breathing the word unauthorized to the bank and you get a chargeback that you can't substantiate without a signed point of purchase authorization from the customer. it's that easy. and many customers know this.

We once had a customer that purchased several videos from us and we verified his IP location, his telephone, his address, all belonging to him. We had a positive CVV2 score, AVS score, we talked to the customer by phone and email, and two months later we got a chargeback from him as an unauthorized transaction. I was pissed! I filed a police report for fraud.
The police showed up at our office, took down a few essentials, and basically said that there is not much they can do but pass the report off to the customers police jurisdiction. And that's the last we heard of it!

Bottom line, give the refund. I think discouraging it in the terms of the site is a good idea, and hinting at repercussions.... but bottom line, give the refund before it becomes a chargeback.