you are right, his refund policy s*cks so much. he believes if he got cards from the victims on first hand doesn't mean another sniffer/spammer cannot get the same card from the victim or card owner cannot realize that he/she has entered card details into a fake site then decide to call the bank to cancel it. you need to start refund 05 code.