Real-Time Refund Spike Alerts with Smart Actions

Why Refund Spikes Matter

One refund is support work. Three refunds in 30 minutes after a release means your checkout is broken, your email confirmation is failing, or a pricing page shows the wrong price. Smart Actions fires the moment the cluster appears.

Step 1: Log Refund Events

// Stripe webhook: charge.refunded
if (event.type === "charge.refunded") {
  const charge = event.data.object;
  const refundAmount = charge.amount_refunded;

  await logit.now("refunds", {
    event: "Refund issued",
    description: `${(refundAmount / 100).toFixed(2)} ${charge.currency.toUpperCase()} refunded`,
    icon: "↩️",
    notify: true,         // notify on each refund + watch cluster threshold
    tags: {
      currency: charge.currency,
      reason: charge.refunds?.data[0]?.reason ?? "unspecified",
    },
    metadata: {
      chargeId: charge.id,
      amountRefunded: refundAmount,
      customerId: charge.customer,
    },
  });
}

Step 2: Create the Spike Rule

Field	Value
Name	Refund spike
Channel	refunds
Event name	Refund issued
Threshold	3
Window	30 minutes
Cooldown	2 hours
Action	Push notification
Push title	↩️ Refund cluster
Push body	3+ refunds in 30 minutes — check billing

Step 3: Add a Slack Webhook

Wire up a second Slack webhook action with the same rule settings so your billing team gets the alert even if they don't have the LogIt app installed.

Refund Reason Breakdown

Log the reason tag to understand the root cause after an alert:

Stripe reason	What it usually means
`duplicate`	Double-charge bug in your checkout
`fraudulent`	Card fraud — check chargeback rate
`requested_by_customer`	Product/service dissatisfaction
`null` / unspecified	Manual refund from support

Tips

Set threshold = 3 for low-volume products, 10+ for high-volume.
Log reason in tags, not just metadata — it lets you filter refunds by reason in the dashboard without parsing JSON.
A 2-hour cooldown gives your team time to investigate without repeated alerts.

Logit