Separate names with a comma.
Talking to the user isn't enough. We need the evidence of the original transaction, as anything can be said after the fact.