Chargebacks and PCI DSS Costs for UK Card Machines in 2026: 2 Hidden Fees

LAST REVIEWED 2026-09-06

What is a chargeback and how does it affect UK card machine users?

A chargeback is a forced refund of a card transaction, initiated by the cardholder's bank. It occurs when a customer disputes a charge, and the funds are taken back from your account. Chargebacks are a normal part of card payments, but they carry fees and administrative burdens.

When a chargeback happens, the acquirer (your card machine provider) typically charges a fee. This fee covers the administrative cost of handling the dispute. The fee is separate from the transaction amount you lose. Chargeback fees vary by provider and can be as high as £35 per dispute.

Chargebacks can arise from fraud, non-delivery of goods, or service issues. The card schemes (Visa and Mastercard) have rules that protect consumers, but merchants must respond within strict deadlines. If you fail to respond, you lose the dispute automatically.

To manage chargebacks, you should keep clear records of transactions, delivery confirmations, and customer communications. The table below shows typical chargeback fees from major UK providers, but always check your contract for exact amounts.

What are the typical chargeback fees charged by UK card machine providers?

Chargeback fees in the UK typically range from £20.00 to £35 per dispute, depending on your provider and contract. Some providers charge a flat fee, while others may waive it for certain account types. The table below shows examples from popular providers.

For instance, SumUp charges a chargeback fee of £20.00, while Zettle and Square charge £20.00 as well. Tide and Worldpay may have different structures, but their rates are not published. Always check your merchant agreement for the exact chargeback fee.

Chargeback fees are in addition to the transaction amount you lose. This can be costly for small businesses, especially if chargebacks are frequent.

To reduce chargebacks, ensure your business practices are transparent, deliver goods promptly, and provide excellent customer service. The table below summarises typical fees, but note that these are examples and may not reflect your specific contract.

How can a UK business defend against a chargeback?

To defend a chargeback, you must provide compelling evidence to your acquirer within the specified timeframe, typically 10 to 20 days. Evidence includes proof of delivery, signed receipts, correspondence with the customer, and any relevant policies.

The chargeback process involves several stages. First, the cardholder's bank raises the dispute. Your acquirer notifies you and may debit the funds immediately. You then submit your evidence. If the bank accepts it, the chargeback is reversed. If not, you can appeal, but the process can be lengthy.

Each card scheme has its own rules. Missing these deadlines means you automatically lose. Therefore, it is crucial to monitor chargeback notifications promptly.

To improve your chances, keep detailed records of every transaction, including IP addresses, delivery tracking, and customer signatures. The table below shows typical response windows, but always check your acquirer's instructions.

What is PCI DSS and why is it relevant to UK card machine users?

PCI DSS stands for Payment Card Industry Data Security Standard. It is a set of security requirements designed to protect cardholder data. PCI DSS v4.0 became the only active version in March 2024, replacing earlier versions.

All businesses that store, process, or transmit card data must comply with PCI DSS. This includes small businesses using card machines. Compliance involves completing a self-assessment questionnaire (SAQ) and possibly undergoing a vulnerability scan.

Non-compliance can lead to fines from your acquirer, and in some cases, the loss of your ability to accept cards. The standard is enforced by the card schemes, but acquirers are responsible for ensuring their merchants comply.

PCI DSS v4.0 introduced new requirements, such as multi-factor authentication and enhanced logging. The table below outlines the timeline of PCI DSS changes, showing that v4.0 is now the sole standard.

What are the typical PCI compliance and non-compliance fees charged by UK acquirers?

PCI compliance fees are monthly charges that acquirers levy to cover the cost of managing compliance. These fees can range from £2.99 to £20.00 per month, depending on your provider. Non-compliance fees are higher and are charged if you fail to submit your SAQ or pass a scan.

For example, some providers charge a monthly PCI fee of £2.99 plus VAT. Others may charge £20.00 per month. Non-compliance fees can be as high as £35 per month. These fees are separate from transaction fees and can add up over a year.

To avoid non-compliance fees, you must complete your SAQ annually and pass any required scans. Your acquirer will provide instructions. The table below shows typical fees, but always check your contract.

PCI DSS v4.0 compliance is not optional. Even if you use a third-party payment processor, you still have responsibilities. The table below illustrates the cost impact of compliance versus non-compliance.

How can UK businesses reduce their exposure to chargebacks and PCI fees?

To reduce chargebacks, implement clear billing descriptors, provide excellent customer service, and use address verification (AVS) and card security codes (CVV). These tools help prevent fraud and reduce disputes.

For PCI compliance, use a validated payment gateway and avoid storing card data. If you use a card machine, ensure it is PCI-compliant and that you follow the provided guidelines. Regularly update your software and train staff on security.

Consider using a chargeback management service, but be aware of additional costs. Some providers offer tools to help you manage disputes, but these may come with monthly fees.

The table below shows how different providers' fees compare, but the most effective way to reduce costs is to prevent disputes and maintain compliance. Always read your merchant agreement to understand your obligations.

Glossary: card payment terms explained

Chargeback: A forced reversal of a card payment initiated by the cardholder's bank, often due to a dispute. The merchant loses the funds and pays a fee.

PCI DSS: Payment Card Industry Data Security Standard. A set of security requirements for handling cardholder data. PCI DSS v4.0 is the current version.

Acquirer: A financial institution that processes card payments on behalf of a merchant. Also known as a merchant bank or card machine provider.

SAQ: Self-Assessment Questionnaire. A form merchants complete to demonstrate PCI DSS compliance. The length depends on how they process cards.

Non-compliance fee: A penalty charged by an acquirer when a merchant fails to submit required PCI DSS evidence or fails a vulnerability scan.

Interchange fee: A fee paid by the acquirer to the cardholder's bank for processing a transaction. Capped at 0.2% for debit and 0.3% for credit cards.

Checklist: what to check on a fee statement or contract

• Check your merchant agreement for the exact chargeback fee per dispute.
• Verify whether your provider charges a monthly PCI compliance fee.
• Ensure you complete your PCI DSS SAQ annually to avoid non-compliance fees.
• Review your provider's fee schedule for any hidden charges like PCI fees.
• Keep detailed records of transactions to defend against chargebacks.

Each item above maps to a line that must appear in the PSR summary box or the contract schedule, so a missing entry is itself a question for the provider.

Frequently asked questions

Who pays for a chargeback?

The merchant pays for a chargeback. When a customer disputes a transaction, the funds are taken from the merchant's account, and the acquirer charges a fee. This fee is typically between £20.00 and £35 per dispute. The merchant also loses the value of the transaction unless they successfully defend the chargeback. Therefore, chargebacks can be costly, especially for small businesses with low margins.

What is PCI DSS?

PCI DSS stands for Payment Card Industry Data Security Standard. It is a set of security requirements designed to protect cardholder data. PCI DSS v4.0 became the only active version in March 2024. All businesses that handle card payments must comply. Compliance involves completing a self-assessment questionnaire and possibly undergoing a vulnerability scan. Non-compliance can result in fines from your acquirer.

Do small businesses need PCI compliance?

Yes, all businesses that accept card payments must be PCI DSS compliant, regardless of size. Even if you use a third-party payment processor, you have responsibilities. Small businesses typically complete a shorter SAQ. Failure to comply can lead to non-compliance fees from your acquirer, which can be as high as £35 per month. It is essential to follow the guidelines provided by your card machine provider.

How long do I have to respond to a chargeback?

The response time for a chargeback varies by card scheme. However, your acquirer may set a shorter deadline, often 10 to 20 days, to allow time for processing. It is crucial to respond promptly with evidence. Missing the deadline results in an automatic loss of the dispute.

Can I avoid PCI fees?

You cannot avoid PCI compliance fees if your acquirer charges them, as they are part of the cost of accepting cards. However, you can avoid non-compliance fees by completing your SAQ on time and passing any required scans. Some providers may waive the monthly PCI fee if you use their payment gateway exclusively, but this is not common. Always check your contract for fee details.