On cancellation, the proof is in the pudding, Many merchants require a written order to cancel, so I would ask your consumer for proof of their cancellation. After you established that they did in fact cancel, the consumer gets the initial unauthorized transaction and those falling within 60 days. Anything beyond that is their loss.