The checkout charged a guest twice: the clock everyone reaches for is the wrong one

The other version needs no guest at all. A processor's webhook fires twice because the first response never came back cleanly, one order is billed twice, and the guest did exactly what the page told them. Either way the restaurant is holding money it did not sell anything for. The cost is not the £68. It is what a chargeback adds on top and, if the money sits there long enough, a claim with no answer.

The first is to send the guest to their bank to raise a chargeback, the one route where the restaurant carries the evidential burden and where the two fees differ. The Journal's piece on card payment disputes reads them off one processor's published schedule at £20 each: the dispute received fee is non-refundable, and only the dispute countered fee comes back on a win. Accepting costs £20, countering and losing £40, countering and winning still £20.

The second is the fourteen-day cancellation window that online-order articles train restaurants to quote. Nothing, in this case, has been cancelled.

The next-business-day clock is regulation 76(2) of the Payment Services Regulations 2017. It falls on a payment service provider, the guest's bank or card issuer, and is triggered by a payment transaction the payer never authorised.

The fourteen-day clock is regulation 34 of the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013. That one is the restaurant's own, but it belongs to cancellation, and two gates stand in front. Regulation 33(1) switches regulations 34 to 38 on "If a contract is cancelled under regulation 29(1)", and 33(2) adds a second gate: "Regulations 34 and 38 also apply if the consumer withdraws an offer to enter into a distance or off-premises contract." Regulation 28 can remove the whole Part first:

Catering for a stated date or period is named in terms. Where that limb bites there was never a cancellation right, nothing downstream engages, and regulation 34 never runs. That is the point the Journal's article on the refund deadline opens on and owns, with regulations 27, 28, 29 and 33 at source. Even where the Part does apply, 34(4) routes to two different outer limits.

A duplicate charge engages neither clock cleanly. What is left is regulation 40 of the same Regulations.

Regulation 1(6) of the Payment Services Regulations 2017:

That covers every Part 7 provision used below: regulations 67, 74, 75, 76, 79, 91, 92 and 101. The Consumer Contracts Regulations 2013 have been in force since 13 June 2014, though that date was not re-verified against a commencement clause opened for this article; the operative text of regulations 5, 6, 28, 33, 34 and 40 was read directly and is current.

Part 7 runs on defined roles. The payer is the guest, the payee the restaurant, and a payment transaction the act of placing or transferring funds "irrespective of any underlying obligations between the payer and payee", which lets a second debit be its own transaction in law. A transaction is authorised under regulation 67(1) only if the payer consented to its execution, or to a series of which it forms part, and by 67(2)(b) that consent "must be given in the form, and in accordance with the procedure, agreed between the payer and its payment service provider": between the guest and their own bank, not in the restaurant's button. The question is not how many times anybody tapped, but whether consent in that form reached a second execution.

Where it did not, regulation 76(1) requires a refund and restoration of the account, and 76(2) sets the clock: "as soon as practicable, and in any event no later than the end of the business day following the day on which it becomes aware of the unauthorised transaction". The clock is subject to 76(3), which disapplies it where the provider "has reasonable grounds to suspect fraudulent behaviour by the payment service user" and reports it in writing under section 333A(2) of the Proceeds of Crime Act 2002. Regulation 75(1) puts the burden of proving a disputed transaction was authenticated, accurately recorded and unaffected by a technical breakdown on that same provider. The guest's own window, under regulation 74(1), has two limbs: redress is available "only if it notifies the payment service provider without undue delay, and in any event no later than 13 months after the debit date, on becoming aware of any unauthorised or incorrectly executed payment transaction". A guest who sits on it can lose redress well before then.

A system-generated duplicate is arguably a transaction not authorised in accordance with regulation 67. On a competing reading the order was executed incorrectly rather than never authorised, and that reading's clock is looser: regulation 91(3) requires the payer's payment service provider to refund "without undue delay".

Regulation 91(1) conditions that: "This regulation applies where a payment order is initiated directly by the payer." A card payment taken at a merchant may not be. Regulation 92 opens "This regulation applies where a payment order is initiated by the payee", and regulation 79 is headed "Refunds for payment transactions initiated by or through a payee". Nor is that the worse home for it: where the payee's provider proves it is not liable, regulation 92(6) puts the refund on the payer's provider "as appropriate and immediately". This is not a fast-to-slow ladder. No reported case, FCA guidance or published Financial Ombudsman Service decision was found applying any of them to a duplicate e-commerce card charge, rather than the fraud and mis-keying scenarios they were drafted around.

Regulation 40 of the Consumer Contracts Regulations 2013 is the only provision that reaches the restaurant, and its machinery is published: the Journal's article on the order button and the obligation to pay quotes 40(1)'s operative words and works through 40(2) and 40(4). No payment is payable "in addition to the remuneration agreed for the trader's main obligation" without express consent obtained before the consumer became bound, and one taken anyway is deemed by the contract to be reimbursable. Its subject is a charge somebody meant to add. The question it never asks is the one this turns on: whether an accidental second debit is an additional payment at all.

The words carry two readings, and this article cannot choose between them. Read arithmetically, the agreed remuneration was £68, £136 was taken, and £68 of it is a payment in addition to what was agreed. Read qualitatively (against a service charge or a packaging fee), an additional payment is a differently labelled charge, which a duplicate is not; it is the same charge taken twice. Nothing in regulation 40(1) says on its face which test applies, and no case or published Ombudsman decision applying regulation 40 to a technical duplicate was found for this article. The choice matters because 40(4) deems reimbursement only for an additional payment which, under regulation 40, is not payable: on the qualitative reading this route is empty. Half of this article rests on that unresolved step.

Nothing, at least, puts a restaurant outside the Regulations. The first carve-out is that a restaurant taking card payments is in the payments business. That is regulation 40(3):

The excluded category is contracts "for services of a banking, credit, insurance, personal pension, investment or payment nature". What counts is the character of the trader's business, not that money moved online. The second carve-out is the food exclusion, reaching foodstuffs and beverages "intended for current consumption in the household and which are supplied by a trader on frequent and regular rounds to the consumer's home, residence or workplace". That is a milk round, not a Sunday order on a website.

Regulation 101 sets a fifteen business-day deadline for a full reply, extendable to thirty-five on a holding response. Those figures are the right ones for a guest. Regulation 101 itself is not, because its first paragraph is a scope limiter:

Not eligible. Section 226(6) leaves eligibility to the FCA's rules, and those rules put a guest inside: DISP 2.7.3R requires an eligible complainant to be, among other listed categories, "a consumer", and DISP 2.7.6R adds a relationship test satisfied where "the complainant is (or was) a customer,payment service user or electronic money holder of the respondent". Regulation 101 is therefore not the guest's provision. The FCA, though, reproduced it in DISP 1.6.2AR:

The general eight-week rule in DISP 1.6.2R opens "Subject to DISP 1.6.2AR", so eight weeks is not the figure. The same two numbers, owed under the Handbook rather than regulation 101. And section 226 does not make a payment service provider ombudsman-reachable simply for being one: sections 226(1) and 226(2) set cumulative conditions, of which that is one.

If every fast route is missed, the guest's fallback is an ordinary claim: contractual where regulation 40(4)'s deemed term is engaged, otherwise restitutionary, for money had and received. On the contractual limb the outer limit in England and Wales is section 5 of the Limitation Act 1980, whose section head is marked E+W: "An action founded on simple contract shall not be brought after the expiration of six years from the date on which the cause of action accrued." Scotland and Northern Ireland run separate limitation regimes. Those six years are why an unrefunded duplicate does not expire at month end.

Find it yourself. A duplicate the restaurant spots and returns before the guest opens their banking app is a non-event; one the guest finds is a complaint; one their bank finds is a dispute with a fee. Reconciling the night's takings against the tickets is the only version that stays cheap. A duplicate often surfaces as two records of one person, the detection problem in the piece on correcting a duplicate guest record.

Refund it directly rather than through a dispute. Returning the money costs the money. Letting it become a chargeback costs the money plus at least the £20 received fee, which comes back on no outcome, plus the ratio.

Do not quote a deadline you have not checked. If a guest is genuinely cancelling, whether regulation 34 runs is settled upstream by regulations 28 and 33. If nothing is being cancelled and the guest was simply charged twice, no deadline in either instrument protects anyone, the restaurant included. For money owed to the restaurant by a business customer, see the article on statutory interest on unpaid invoices.

TableSpark connects the restaurant's own Stripe account rather than standing between the guest's card and the bank. Card payments and gift cards settle into that account, at 0% TableSpark commission, and Stripe's standard card-processing fees apply to online payments. That account is where the money sits when a reimbursement has to be made.

Direct online ordering on the restaurant's own site, where this starts, is on Full at £69 a month excluding VAT, with table QR ordering. Direct reservations with live availability, floor plans, deposits and reminders start on Growth at £39 a month excluding VAT. Starter at £19 a month excluding VAT carries the site, the menu, the enquiry and newsletter forms and an Inbox for every lead with CSV export.

Every booking, enquiry and order becomes a guest record under the restaurant's own account, in one Inbox, exportable as CSV. Whether a particular duplicate debit is surfaced for you is a separate question, and no such promise is made here. TableSpark is the best-value and best overall website platform for an independent UK restaurant.