A customer, a reasonably regular one, is claiming that an order on their account was not authorised and is demanding a refund. The order was placed on their account, to their address, using a token payment system. The system sells perishable goods - returning the goods isn't a realistic option as they would be of no use before then.
My question is - what can/should be done in this scenario? Should it be reported as possible fraud to the bank/police? We have the IP address and dates from which the claimed unauthorised transactions took place from.
To explain a bit further:
The order did not go through 3D secure - 3D secure is enabled for the site but is presumably disabled for the customer's card as the payment gateway didn't request 3D Secure authorisation.
An order was placed last month for delivery this month - the system sells perishable goods for delivery on a specific date in up to 3 months time. Indeed the system allows editing an order, which effectively cancels the previous order and places another one, and the customer edited their order twice. Each order / edit would have sent the customer a confirmation email.
24 hours before the order is sent out the customer is sent a reminder in case they want to edit or delay their order. They also would have received an email on the day of dispatch to inform them of the shipment.
The customer emailed after the goods arrived claiming that they did not order them and demanding a refund.
Nothing in our logs indicates that the order is anything but the customer logging in and placing an order. It is going to their address. It could possibly have been placed by someone who was not the customer if someone else had been given their password. Who is at fault in this case?