[abeyer]

They clearly must have the records if they have the ability to retroactively revoke access to it, as they must know who had the access to revoke. Perhaps the user needs to update their payment method to get the refund, or like everyone else who deals in other people's money, you apply the existing laws around unclaimed funds if you're truly unable to process the refund.