If the unauthorised transaction included funds from cashback or other promotions, can a user still get a full refund?