Those are fairly small pitfalls. You can send money back without a refund button. Authentication is done through your bank, if your bank has 2FA, then you have 2FA for Interact. Not sure what you are referring to about the payment address, but declaring the email the unique ID seems to be a decent solution for me.