The 'buyer' still has the goods, and now has the money too. You can sue, and probably get them arrested for fraud. If they have the identification information they say they do, it should be a slam-dunk case. It's as though they walked in and took the lumber after closing time. The system isn't to blame, the clown who defrauded the mom and pop shop committed a crime, and there's lots of ways to do that.
If Visa, MasterCard, Amex, et al., or PayPal make a decision, most businesses have little recourse. The cost of not accepting cards is too high.
Ergo, payment processors can essentially set their own terms.