The Refund Without an Order

19 refunds in the system reference order IDs that don't exist anywhere in the orders table. Total: ₹91,770 paid out. A customer service agent exploited a validation gap — the refund API accepted any order_id string without checking existence.