One of the options: money go to a 2/3 multisig address, 1 key is controlled by the customer, 1 key is controlled by the service provider, 1 key is controlled by an escrow service.