Saying “I would like to make a refund” sent a verification code straight away. No order number, no question about what had gone wrong. Your receptionist was treating the request itself as the explanation, so it believed the caller had already said everything it needed. Asking for a refund is not a reason for one, and it is not treated as one now: the caller is asked which order and what happened, in that order, before any code is sent.
The customer’s email address is no longer read out on a refund call. Asked “what address did you send it to?”, your receptionist would say the whole address aloud. On a refund that address comes off the order rather than from the caller, and whoever is holding the phone is not always the customer. It now says only the provider — “the address attached to the order, at gmail dot com” — which is enough for a real customer to recognise and not enough to hand anyone anything. An address the caller dictates on the call is still read back in full, because they are the one who just said it.