You can achieve this with the Teams Management - effectively the refund can be 'protected' and made accessible by only those who have permissions. The 'password' would effectively be the PIN of a user that has access.
On the free plans you only have one set of team permissions, so you'd need to remove the refund permission from the team. The only way to access the refund would be with the 'owner' pin. Bare in mind that this would also give you access to all other functionality not covered by the team permissions.
On the plus plans you have finer control over the permissions.
More details here:
Get Started with Team Management | Square Support Centre - AU (squareup.com)
