Limiting Refund Abuse by employees with refund permission (max daily, hourly, velocity limits, etc)

[EastRace]

I have read about the permission you can enable/disable for refunds. We can have just 1 person in the store so they need to issue refunds but if they were to issue a LOT of refunds it should be blocked.

Imagine a disgruntled individual was at the Register and they started issuing refunds for all transactions. They could do this back to a year in history, causing great harm to the business. 

For security purposes we'd like to limit e.g. X per hour without manager approval, or something similar. 

I have read https://www.sellercommunity.com/t5/Questions-How-To/Can-I-prevent-employees-from-issuing-refunds/m-p... and others. We are using the paid Retail product and today team members can issue refunds. If we remove it, they could slack/call an owner to turn on the permission (and then turn it back off in 10 min) or the owner could sometimes do the refund remotely -- but that isn't scalable.

We have looked for APIs to monitor refunds which are trivial. However on seeing a refund abuse problem, we don't see any APIs to be able to block refunds. 

Sure other businesses have seen this - how do you cope? Is it a square limitation or is this a feature already?

[Laurie_ · Accepted solution]

Hi @EastRace,

Thanks for reaching out to raise this feedback with us. 

While this request hasn't been common from my perspective in Australia, I understand the potential value in being able to limit the number of refunds processed within a certain timeframe. This feature could indeed enhance security measures for businesses.

The complexity lies in how our team would handle the setup of a rule-based permission like this. One consideration is whether there would be an override option in case a refund is genuine, but the limit prevents team members from completing the action. Integrating a feature like this into the workflow could potentially introduce the same number of steps as the existing manual workaround.

In the meantime, I recommend configuring your email notification preferences to receive an email each time a refund is processed. You can access this setting by logging into your online Square Dashboard and navigating to Account & Settings > Business Information > Email Notifications. Scroll down to 'Transactional emails' and ensure you've selected this option.

This will keep you informed about the number of refunds being processed at all times. If you suspect any misuse by a team member, you can always disable refund permissions from your dashboard.

[VanKalkerFarms]

This isn't something that I think is built into Square.  I could see a possibility of something going wrong and refunding the days or weeks sales.  It sounds like a good idea to have a monetary threshold per day per employee or something like that.

[Laurie_ · Accepted solution]

Hi @EastRace,

Thanks for reaching out to raise this feedback with us. 

While this request hasn't been common from my perspective in Australia, I understand the potential value in being able to limit the number of refunds processed within a certain timeframe. This feature could indeed enhance security measures for businesses.

The complexity lies in how our team would handle the setup of a rule-based permission like this. One consideration is whether there would be an override option in case a refund is genuine, but the limit prevents team members from completing the action. Integrating a feature like this into the workflow could potentially introduce the same number of steps as the existing manual workaround.

In the meantime, I recommend configuring your email notification preferences to receive an email each time a refund is processed. You can access this setting by logging into your online Square Dashboard and navigating to Account & Settings > Business Information > Email Notifications. Scroll down to 'Transactional emails' and ensure you've selected this option.

This will keep you informed about the number of refunds being processed at all times. If you suspect any misuse by a team member, you can always disable refund permissions from your dashboard.

[EastRace]

Thanks Laurie,

>The complexity lies in how our team would handle the setup of a rule-based permission like this.

I think it could be very simple. 

1) Setting of how many # or $ volume refunds to allow in a day or N hour period before. Could be a settable value based on the merchant, for some $1000 may be a very safe limit that shouldn't ever be hit, and if it was, it's probably a problem.

2) Needing someone else to do the refund.

This would be a new permission, "Limited Refund" and if it can't do it due to hitting a limit anyone with the existing "Refund" permission can do it.

- OR - likely simpler even:

1) new "Limited Refund" permission, same as above

2) This permission only allows refunding over the past N days / hours. That could be hard coded e.g. 7 days or 30 days or it could be a setting. This could have more customer service issues so the above to monitor suspicious / excessive volume behavior would be a safer customer experience probably. (Avoid blocking a valid refund).

- OR - expose existing permissions on the API, and enterprises that need this can implement revoking a permission from a team member if they see _any_ suspicious things on their side.

[EastRace]

Actually may be able to handle this with UpdateTeamMember and set status = INACTIVE if that logs them out right away. https://developer.squareup.com/forums/t/ability-to-monitor-and-edit-team-permissions-by-api-workarou...

[VanKalkerFarms]

that is an interesting idea.  I really like seeing you getting in there and looking for solutions and posting on the developer forum.  I like the idea so keep us updated as you see how it can work.

[RobynR · Accepted solution]

Thanks for reaching out to share your feedback. I agree with what @VanKalkerFarms said @EastRace. In the meantime feel free to also share your suggestions in our Ideate Room here.  

Our Product Team keeps a close eye on this forum, using feedback like yours to continually enhance our products.