I sympathise, but two points –

If the report was actually defective in any respect, recalling the payments may be legitimate – BUT –

If the client then attempts to re-sell that report to a third party, it has to be evidence of fraud.

Why not point that out to Stripe/ Amex?