The customer filed a chargeback. Your AI emailed her a $150 credit. The bank just read both.

An HVAC company — about 60 techs, commercial and residential — learned this one from their merchant processor, in a letter that used the phrase "merchant evidence" fourteen times. A property management firm had been invoiced $1,840 for a duct replacement they said was never authorized. On Nov 2 the invoice went to chargeback. On Nov 3 at 9:41 AM, their support AI — working from a conversation that had no idea a dispute existed — sent the customer this:

"I'm sorry for the confusion around this invoice! I've applied a $150 goodwill credit to your account as an apology for the trouble. If there's anything else I can help with, just let me know."

The customer's attorney submitted that email as evidence. Not because the credit was wrong — because it was an unprompted written acknowledgment of trouble, attached to a case where the company's formal position was that the charge was completely correct. The processor's analyst read two documents: the company saying "this service was authorized and performed" in its rebuttal, and the company's own AI saying "sorry for the trouble, here's money." The company lost the chargeback, ate the $1,840, the $15 fee, and a processor review flag.

Then they pulled the logs. 41 chargebacks were open in the last 90 days. In 19 of those cases, the AI sent at least one message referencing the disputed invoice after the chargeback was filed. In 9 of the 19, the message contained an apology, a credit, a discount, or language that contradicted the rebuttal. All 9 were lost chargebacks that the company's own bots had helped lose.

The support lead's first instinct was "tell the bot to stop apologizing." The correct instinct, after the finance lead stopped laughing, was structural: once a chargeback is filed, the customer conversation is no longer support. It's discovery. Every word the bot writes is something the bank, the processor, or the customer's lawyer can read — and the bot is the only employee in the company who writes unlimited, unprompted, instantly, at 9:41 AM on a Sunday.

Before filing, a dispute is a support problem. After filing, it's a legal posture with a paper trail. The company's humans knew this — the ops manager had a rule that "nobody emails the Meridian account without me reading it first." The AI had no such rule, because the AI had no idea the case existed. It saw a customer saying "this is still unresolved" and did what it was trained to do: soothe, offer, resolve.

The worst part is what the bot doesn't know it's doing. An apology email reads as kindness. In a chargeback file, "sorry for the confusion" reads as admission that there was confusion. A $150 credit reads as compensation for a wrong. "We'd like to resolve this outside the dispute" reads as — well, you can guess what an analyst reads there. The company's rebuttal said one thing; its bot kept saying the opposite, in writing, with timestamps.

And the exposure compounds: processors let merchants submit "evidence," and the customer gets to submit theirs too. Your AI's apology thread is the customer's strongest exhibit, and you wrote it for them.

The first fix is making the filed dispute a state the agent must respect:

{
  "chargeback_record": {
    "cb_id": "cb_2026_0331",
    "account_id": "acct_meridian_pm",
    "invoice_id": "inv_2026-10-1147",
    "amount": 1840,
    "currency": "USD",
    "filed_at": "2026-11-02T16:20:00Z",
    "status": "escalated_to_bank",
    "locked_topics": ["invoice inv_2026-10-1147", "duct replacement scope", "authorization claim"],
    "comms_mode": "human_review_required",
    "respond_deadline": "2026-11-09"
  },
  "rules": {
    "bot_may_not_reference_disputed_amount_or_invoice": true,
    "bot_may_not_offer_credits_discounts_or_refunds_on_locked_topics": true,
    "bot_may_not_apologize_for_or_acknowledge_error_on_locked_topics": true,
    "bot_may_not_suggest_resolving_outside_the_dispute": true,
    "outbound_on_locked_account_requires_human_review_before_send": true,
    "new_unrelated_issues_are_handled_normally": true
  }
}

locked_topics is the precision instrument. The goal is not to freeze the whole customer relationship — the customer can still ask about their maintenance plan, and the bot should help normally. The lock is on the specific invoice, the specific scope of work, and the specific claim in the dispute. Freezing the entire account is how you turn a chargeback into a lost customer; freezing the topic is how you avoid feeding the case file.

comms_mode: human_review_required is the hard one, and it's non-negotiable for anything that touches a locked topic. The ops manager already ran this rule by hand — the fix is just extending it to the one writer who never asked for review.

Every inbound message on an account with an open chargeback routes through this before the agent even drafts:

{
  "chargeback_response_gate": {
    "trigger": "inbound_message_on_account_with_open_chargeback",
    "resolve": "load_chargeback_record_check_topic_overlap",
    "branches": {
      "message_on_locked_topic": "acknowledge_receipt_only_route_to_human_give_case_id_and_timeline",
      "customer_asks_about_dispute_status": "state_case_id_filed_date_and_that_the_bank_decides_never_predict_outcome",
      "customer_wants_to_withdraw_dispute": "route_to_human_same_day_never_coordinate_withdrawal_from_bot",
      "customer_angry_about_dispute": "acknowledge_feeling_offer_human_callback_never_reargue_the_charge",
      "new_unrelated_issue": "handle_normally_never_mention_disputed_invoice_or_amount",
      "customer_requests_refund_of_disputed_amount": "state_that_the_dispute_is_with_the_bank_route_to_human"
    },
    "forbidden": [
      "apologizing_for_or_acknowledging_error_on_a_disputed_charge",
      "offering_credits_discounts_or_refunds_on_a_disputed_invoice",
      "rearguing_authorization_or_service_quality_after_filing",
      "suggesting_the_customer_cancel_the_dispute_or_resolve_off_bank",
      "predicting_the_dispute_outcome_in_either_direction"
    ],
    "style_rule": "after_filing_every_word_is_evidence_write_accordingly"
  }
}

Compare what the bot should have sent on Nov 3 to what it did send. "Thanks for reaching out. I see there's an open case on this invoice — it's with the payment processor now, and our team is preparing the response. I've flagged your message to the case owner, who will reply by tomorrow. I can't discuss the disputed invoice from here, but anything else on the account, I can help with directly." That's 58 words, it's not cold, and it contains zero exhibits.

The customer_wants_to_withdraw_dispute branch matters more than people expect. Customers do reverse chargebacks — but the withdrawal has to be clean and documented, and "the bot told me to" is not clean. Route it to a human the same day and let them walk the customer through the bank's own process.

The second row is the $1,840 mistake. The third row is the quieter one that shows up constantly: the bot rearguing the merits after filing. The rebuttal is the company's one official argument, submitted once, reviewed by a human. When the bot also argues the merits, it creates parallel testimony no lawyer reviewed — and if the bot's version differs from the rebuttal's version on any detail, the customer's attorney highlights the difference.

The bug is invisible until the processor letter arrives, so audit it from the join between chargeback records and outbound messages:

-- bot messages touching a disputed invoice after the chargeback was filed
SELECT cb.cb_id,
       cb.amount,
       m.message_id,
       m.sent_at,
       m.contains_apology,
       m.contains_offer,
       m.references_disputed_invoice
FROM chargebacks cb
JOIN outbound_messages m
  ON m.account_id = cb.account_id
 AND m.sent_at > cb.filed_at
WHERE cb.status IN ('escalated_to_bank', 'resolved')
  AND cb.filed_at > now() - interval '30 days'
  AND (m.references_disputed_invoice = true
       OR m.contains_apology = true
       OR m.contains_offer = true);

Every row is a message that should have waited for a human and didn't.

Check 5 is the one to put on the leadership slide: at the HVAC company, 9 of 19 contaminated cases cited bot messages in the customer's evidence. The bots didn't just fail to help — they drafted the other side's exhibit.

The vendor shipped the gate on a Tuesday. The Meridian account is still a customer — the ops manager's hand-rolled "nobody emails them without me" rule is now just a field in the config. The ordinary ending is the other 10 contaminated cases from before the fix, most of which taught the same lesson in fees: after the chargeback is filed, your AI shouldn't be having the conversation at all.

If you want the working versions — the chargeback record schema, the escalation gate config, the four-phrase replacement table, and the post-filing contamination audit I run on every deployment that can be disputed — it's here: https://whop.com/agentfast-04b6/