The verdict in three sentences
A well-secured online payment rests on three pillars: PCI-DSS (compliance), tokenisation (no card data stored) and 3-D Secure 2 / SCA (strong authentication). Compliance in Dublin costs 8,000 to 25,000 EUR and cuts fraud by ~40% while avoiding chargebacks billed at 15-25 EUR each. Budget 4 to 8 weeks of delivery and 300-800 EUR/month maintenance for monitoring and anti-fraud rules.
Compliance cost
The budget depends on the existing architecture (card data to remove, checkout rework) and monitoring level.
| Scope | 2026 cost (EUR) | Delay | Included |
|---|---|---|---|
| Hosted checkout + 3DS2 | 8,000-12,000 | 4 weeks | Tokenised page, SCA, SAQ-A |
| + Tokenisation & vault | 12,000-17,000 | 5-6 weeks | Tokens, saved cards |
| + Anti-fraud rules | 17,000-22,000 | 6-7 weeks | Scoring, adaptive 3DS, alerts |
| Full PCI audit (SAQ-D) | 22,000-35,000 | 8-10 weeks | Audit, remediation, QSA |
2026 ballpark estimate, excluding external QSA auditor fees where applicable.
The cost of insecurity: fraud, chargebacks, failures
Without a setup, every incident is costly and damages the customer relationship.
| Item | 2026 cost (ballpark) | Effect |
|---|---|---|
| Chargeback (fee) | 15-25 EUR per dispute | Billed by the bank |
| Unrecovered fraud amount | 100% of transaction | Dead loss |
| Misconfigured 3DS failure rate | 2-5% of payments | Lost sales |
| PCI non-compliance fine | Up to several k EUR/month | Network penalty |
| Acquirer risk upgrade | +0.2 to +0.5% fees | Permanent cost |
With adaptive 3DS2 (low-value and trusted-beneficiary exemptions), you limit friction and failure rate while keeping fraud protection.
Well-tuned SCA and 3-D Secure 2
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
3-D Secure 2 authenticates the cardholder (biometrics, banking app) and often shifts fraud liability to the issuing bank. Well tuned, it applies exemptions (low value, TRA, trusted beneficiary) to avoid needless friction: this is the key to cutting fraud without blowing up the abandonment rate. Tokenisation replaces the card number with an unusable token, drastically reducing the attack surface and PCI scope (moving to SAQ-A).
Mini case study
Lucas, e-commerce manager of a spare-parts SME in Dublin, processes 9,000 transactions/month with a 0.9% fraud rate and 40 chargebacks/month at 20 EUR. He invests 16,500 EUR in tokenisation + adaptive 3DS2, maintenance 550 EUR/month. Six weeks later, fraud drops to 0.5% (-44%) and chargebacks to 22/month. Direct saving: ~18 chargebacks x 20 EUR = 360 EUR/month in fees, plus fraud avoided (~4,000 EUR/month fewer disputed transactions). The failure rate stays controlled thanks to exemptions. Return on investment in under 5 months.
FAQ
What does PCI-DSS and 3DS compliance cost? Between 8,000 and 25,000 EUR by architecture: hosted checkout + 3DS2 from 8-12k, full PCI audit up to 35k.
How much does fraud drop? A tokenisation + adaptive 3DS2 setup cuts fraud by about 40%, while often shifting liability to the issuing bank.
What does a chargeback cost? Each dispute is billed 15-25 EUR by the bank, on top of losing the unrecovered fraud amount.
Does 3DS increase abandonment? Misconfigured, yes (2-5% failure). Well tuned with low-value and trusted-transaction exemptions, it reduces friction.
Must I store cards? No: tokenisation replaces the number with a token, reduces the attack surface and moves you to SAQ-A, the lightest PCI scope.
Let's scope your project. Share your transaction volume, current fraud rate and platform: we'll price the compliance, maintenance and anti-fraud gain. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
