Merchants should not be accepting time-locked txid's for usual business, and should just refund any that they receive to the original address(es) - though that becomes more complicated if there are multiple inputs and outputs, so it's not automatically clear where the refund should go to. In that case, it's best for the customer to write an email to the merchant with the txid they sent, as for a refund, and supply their address.

It will simplify things for them to have a "no timelocked transactions" policy on their terms of service, and an "if you send us a timelocked transaction, we will not process it so please email us for refund instructions" clause.