I have an issue as i have been charged twice by a hotel

I made a online booking and selected to pay at same time using credit card (not debit card)

For some reasons hotel send automated email asking to confirm or renew payment cause they claimed they couldnt charge me , which i ignored cause i wanted to avoid double charges

Anyway , arrived at the location , the staff checked and confirmed i wasnt charged for this and i paid on site using another card (debit)

Few days later , checking bank statement of my credit card i can see i was in fact charged for my stay , and online payment went through

wrote to hotel , which then quickly recognize the mistake

However to revert the payment done on site with my debit card , they are asking for card number, the expiration date and CVC for the refund

Something which is of course not good , so i am looking for alternative to such request

Any ideas ? Whats the process in such cases ?