If a customer goes to their bank and disputes a payment they made on my website, who ends up losing that money?

In most cases it is you, at least to begin with. When a cardholder raises a dispute, the bank pulls the money back out of your settlement first and asks questions afterwards. The supplier has already been paid for the flight or the hotel and will not hand that back just because your customer complained to their bank, so for a while you are out of pocket on both sides. Whether you get it back depends on the evidence you can produce and on the dispute rules of the card scheme, not on the booking system.

What the software can do is make that evidence easy to find. Every booking keeps its own trail of who searched, what was quoted, what the customer agreed to, when the confirmation went out and what the supplier returned, and all of that can be pulled up against a single reference. Most disputes are won or lost on whether you can show the customer received the service and accepted the cancellation terms, so having the confirmation, the terms shown at checkout and the supplier reference in one place matters more than anything clever.

It is also worth knowing that many disputes are not fraud at all. The customer simply does not recognise the name on their statement. If your bank descriptor shows a payment company rather than your trading name, people panic and call their bank. Getting that descriptor changed to something the customer will recognise quietly removes a good number of these before they start.

Check what your business name looks like on a card statement, and ask your gateway how long you get to respond to a dispute, so you are not caught by a deadline you did not know about.