The cost of a chargeback in 2026 isn’t limited to the lost transaction amount. For an €80 disputed transaction, the merchant typically absorbs: full transaction refund, processor chargeback fees (€15-50), network penalty if chargeback rate exceeded (Visa Dispute Monitoring, Mastercard Excessive Chargeback), lost merchandise, and internal dispute management cost. Full cost: €120-180 for an €80 transaction. Beyond a certain threshold, the processor threatens merchant account closure.
In 2026, the typical chargeback rate for a B2C PrestaShop store is 0.3 to 0.8% of transactions. In some high-risk sectors (vape, electronics, digital content, cosmetics) it easily climbs to 1.5-3%. The Visa critical threshold is 0.9%, beyond which penalties activate. Implementing clean anti-fraud machinery isn’t a comfort — it’s a survival condition for these sectors.
3DS2 and SCA: the mandatory framework since 2021
Since PSD2 full effect in 2021, Strong Customer Authentication (SCA) is mandatory for most e-commerce transactions in the EU. Concretely, 3D Secure version 2:
- Triggers additional verification (biometrics on the banking app, SMS code) at payment time.
- Transfers chargeback liability to the cardholder (and their issuing bank) for « stolen card » fraud.
- Increases payment failure rate by 5-15% due to additional user friction.
3DS2 doesn’t eliminate all chargebacks. It addresses about 60% of third-party fraud (stolen card), but doesn’t cover friendly fraud (legitimate buyer disputes the transaction afterward), which represents 15-35% of chargebacks depending on sector.
SCA exemptions to know
- Low Value Transaction (LVT): transactions under €30 can be exempted (with cumulative card limit).
- Transaction Risk Analysis (TRA): if processor has low fraud score (TRA Acquirer Reference Rate under 0.01%), exemption can be requested.
- Merchant whitelisting: cardholder can authorize a specific merchant to transact without SCA.
- Merchant Initiated Transactions (MIT): recurring payments after valid initialization.
Properly configuring these exemptions reduces friction without degrading security. A topic to pilot with the payment gateway.
Fraud scoring: the layer above 3DS2
3DS2 protects against « stolen card » fraud, but detects neither sophisticated fraudsters (using legitimate cards with successful SCA) nor friendly fraud. The complementary layer is fraud scoring: signal analysis to calculate fraud probability before capture.
Scored signals
- Geographic coherence: France billing address, Romania IP, Belgium delivery. Score increases.
- Velocity: number of transactions attempted on the same card or IP in last 24h.
- BIN check: is the card’s issuing bank coherent with the billing address?
- Navigation behavior: time on site, journey, card number copy-paste (bot signal).
- Device fingerprinting: browser fingerprint shared with other accounts?
- Email pattern: disposable address, recently created, suspicious format.
- Delivery address: reshipping (hotels, rarely-used pickup points, illegitimate freight services).
- Buyer history: new vs returning account, first payment vs repeated orders.
Three solution families in 2026
Specialized pure-players: Signifyd, Riskified, Forter, NoFraud. Guarantee on fraudulent chargebacks (provider pays the chargeback if they approved the transaction). Price: 0.5-1.5% of transactional revenue. Main ROI for revenue exceeding €2M/year and high-risk sectors.
Payment gateway integrated tools: Adyen RevenueProtect, Stripe Radar, Mollie Fraud Detection. Price: 0.1-0.3% of revenue. Less powerful than pure-player but virtually no additional integration. Sufficient for 80% of mid-market stores.
In-house rules: a PrestaShop module with simple rules (refuse disposable emails, block anonymizing IPs, ceiling on first order). Cost: €0-5K dev. Catches 30-50% of basic fraud, misses sophisticated fraud.
The full cost of a chargeback in detail
On an €80 transaction disputed and lost by the merchant:
- Transaction refund to cardholder: -€80
- Processor chargeback fees (Stripe, Adyen, Mollie): -€15 to -€50
- Lost product cost (merchandise was delivered): -product gross margin
- Logistics cost: -€3 to -€8
- Internal dispute management cost (1-3h back-office): -€30 to -€90
Total: €120-200 for an €80 transaction. On stores where chargeback rate climbs to 2%, total cost is 2.5-4% of revenue — often more than net margin.
The triple effect of a high rate
- Visa Dispute Monitoring penalty starting at 0.9%: $25-50 per chargeback in network penalty.
- Mastercard Excessive Chargeback Program above 1.5%: $100 per chargeback.
- Merchant account closure by processor if rate sustained above 1%.
Friendly fraud: 15-35% of chargebacks
Friendly fraud is committed by the legitimate buyer, not a third-party fraudster. Common scenarios:
- « I didn’t receive the product » when it was delivered (even with proof).
- « I didn’t authorize this transaction » after an order under influence or by a child.
- « The product doesn’t match the description » on perfectly conforming products.
- « The transaction is unauthorized recurring » on subscriptions explicitly consented.
3DS2 doesn’t protect against friendly fraud. Defense goes through:
- Signed delivery proof (Mondial Relay, Chronopost expert).
- Clear consent trace for subscriptions (archived double opt-in).
- Documented and archived product descriptions and photos.
- Fast dispute response (under 7 days) with complete file.
- For repeat offenders (same email, same device), progressive blacklist.
2026 implementation on PrestaShop
Layer 1: properly configured payment gateway
- Activate 3DS2 with properly configured LVT and TRA exemptions.
- Activate processor integrated scoring (Stripe Radar, Adyen RevenueProtect, Mollie Fraud).
- Configure thresholds: auto-refuse above a score, manual review between two thresholds, accept below.
- Monitor KPIs via processor dashboard.
Layer 2: PrestaShop pre-screening
- Module or custom code verifying: disposable email (via Kickbox or Emailable API), VPN/Tor IP (via MaxMind, IPQualityScore), coherent address (BIN check).
- Block in pre-checkout, before payment attempt. Avoids attempt fees and patterns detected by the network.
- First-order ceiling (e.g., €200 max for new account) discouraging volume fraudsters.
Layer 3: continuous monitoring
- Weekly dashboard: chargeback rate by product, payment method, traffic source.
- Automatic alert when monthly rate exceeds 0.5%.
- Monthly meeting to review chargebacks and identify patterns.
When to invest in a pure-player anti-fraud
Riskified, Signifyd, Forter cost 0.5-1.5% of revenue. Question: does their chargeback guarantee (they pay if the transaction they approved is fraud-disputed) offset the cost?
Simple rule: if current chargeback rate exceeds 0.8% and revenue exceeds €2M/year, ROI is almost always positive. Below, the gateway-integrated tool suffices for most cases.
Pitfalls to avoid
1. Refusing too broadly to avoid fraud
Too-strict scoring refuses real transactions (false positives). For 100 wrongly-refused transactions, that’s 100 lost carts and as many customers who won’t try again. Trade-off is economic: current fraud rate vs accepted false positive rate. Pilot with KPIs.
2. Not responding to disputes
An uncontested chargeback is lost by default. On friendly frauds with delivery proof and consent trace, merchants win 40-60% of disputes when properly responding. Don’t neglect — that’s 1-3% of revenue at stake.
3. Confusing attempt and capture
A payment attempt refused by 3DS2 isn’t a chargeback. Important distinction for monitoring: don’t confuse authentication failure rate, payment failure rate, detected fraud rate, chargeback rate.
4. Configuring 3DS2 without testing
Processor sandbox essential. On an FR, AT, DE, ES card set, SCA behavior may differ (issuing bank, authentication mode). Test on multiple test cards provided by Stripe / Adyen / Mollie before production.
5. Underestimating HR cost
Managing 50 chargebacks per month without tools = 2 days/week of a back-officer. Hidden cost. Beyond a certain volume, outsourcing via Chargeback911, Chargebacks Gurus or an integrated pure-player becomes profitable.
Conclusion: defense in depth, not a single layer
Payment fraud in 2026 isn’t handled with a single tool but with defense in depth: properly configured 3DS2, payment gateway scoring, PrestaShop pre-screening, weekly monitoring, systematic dispute response. For high-risk sectors, a pure-player anti-fraud layer.
The right cost / benefit trade-off depends on current chargeback rate and sector. For a standard B2C store at 0.3% chargeback, gateway-integrated tool suffices. For a vape or electronics store at 1.5%, a pure-player justifies itself. In all cases, measuring full chargeback cost (not just transactional amount) remains the step that unlocks the right trade-offs — and the most often forgotten.
