Customer support: fraudulent refund investigation