Same thing happened to me. I git charged for a “refund” for a sale I never made. It took myaccount into the red and they demanded money and even more ID from me so I closed it. Stuff like this is why I don’t keep money in any place other than my bank acct. They also instantly and without warning locked my account after receiving 2000 dollars from a friend before that and demanded official documentation after I started investigating what happened citing EU laws. I wouldn’t have minded that since I’m not a criminal but surely locking away someone’s account without explanation is not a good way to take care if users. Especially if you’re basically a bank.

Maybe I am in the wrong here but my approach each and every time to a project where I deal with someone elses' money is to try and figure out the most secure and most informative way to do everything, afterall it's one of the biggest responsibilities you can take on as an online service provider.