PayPal generally has Reg E responsibility when it is used. See 1005.14. But Reg E doesn't care if the consumer received or is happy with the goods or services, only that the transaction was authorized. So while late to the party, double no. They need to go back to PayPal.
My opinions are not necessarily my employers.
Rules and Regs minus Relationships equals Resentment and Rebellion. John Maxwell