Buy now pay later (BNPL) fraud: Types, risks and prevention
The seven kinds of BNPL fraud, what they cost merchants and providers, the controls that stop them, and how Sensfrx scores each signup, login and payment.
By 7 mins readPublished Updated On this page
Buy Now, Pay Later lets a shopper take the goods now and pay in instalments. Shoppers like it, merchants like the bigger baskets, and fraudsters like it most of all: the decision happens at checkout in seconds, and the goods leave before the first instalment is due. A 2023 Grand View Research report put the BNPL market at nearly $6.3 trillion by the end of the decade.
A FICO report found that 23% of US consumers said their information had been used to open a BNPL account without their consent.
Merchants and BNPL providers both carry the risk. What follows is what BNPL fraud looks like, what it costs, and the controls that stop it.
What BNPL fraud is
BNPL fraud is any scheme that abuses a Buy Now, Pay Later arrangement to get goods, credit or money the fraudster never intends to pay for.
It grew as payment processors and merchants added BNPL to checkout. Unlike a traditional loan, a BNPL decision is made in seconds with little friction, and that speed is what the fraudster uses.
Merchants that offer BNPL have to stop the fraud without adding friction for the real customers. Too little checking and the losses mount; too much and good customers abandon the cart, churn, or stop trusting the brand.
Types of BNPL fraud
Seven patterns account for most of it.
First-party fraud. A real person opens a BNPL plan in their own name with no plan to pay. It works where the provider's collection process is weak.
Account takeover. The fraudster gets into a legitimate BNPL account, usually through phishing or a reused password, and buys on the account holder's credit.
New account fraud. Fake accounts opened with stolen identities, aimed at providers whose verification is weak.
Synthetic identity fraud. The application uses a name built from real and invented details, which makes it hard for the provider to spot.
Fraudulent chargebacks. The customer buys, receives the goods, then disputes the charge, counting on BNPL systems being lenient about chargebacks.
Never-pay fraud. The customer takes goods or services on BNPL with no intention of paying any instalment, using the deferral to get clear before anyone notices.
Transaction fraud. Illicit money is pushed through BNPL channels to disguise where it came from, which makes it harder to trace.
What BNPL fraud costs you
The losses do not stop at the fraudulent order.
Reputation. A BNPL fraud means someone got into a customer's account, or opened one in their name, and bought on it. The customer's personal data was misused on your platform.
Customers conclude the merchant cannot protect them. They shop elsewhere, and they say why.
Money. The BNPL provider usually carries the loss on a fraudulent purchase, but the purchase still ran through your store. The goods are gone and the chargeback fee is yours.
Without controls the chargebacks keep coming. A merchant that keeps sending fraud to its provider pays more for the service, or loses it.
The provider relationship. If fraud keeps coming through your platform, the BNPL provider can cut you off. That removes a payment option your customers expect and hits sales directly.
Chargebacks. Fraudulent transactions end in chargebacks. A high chargeback rate brings penalties from payment processors and closer scrutiny from banks.
Operations. Every fraud case pulls staff onto investigation and recovery and off the work that grows the business.
BNPL fraud prevention strategies
Prevention rests on three things: checking who the applicant is, scoring the risk in real time, and watching transactions after approval. These are the controls that do it.
Multi-factor authentication. Confirm the user with something beyond the password: a one-time code, a PIN or a biometric check on the device.
Identity verification. Require proof of identity at signup, such as photo ID, a selfie check or document verification, backed by a real-time check that the applicant is a real person and not a bot or a synthetic identity.
Device fingerprinting. Tie each device to its history of payments and actions. A device already linked to fraud, or one that suddenly sits behind many accounts, gets flagged.
Behavioural biometrics. Compare typing speed, mouse movement and navigation against the account owner's normal pattern and flag the session when it does not match.
Machine learning. Models score large volumes of transactions in real time and learn which patterns recur, so repeat offenders are blocked on sight.
Transaction monitoring. Read every purchase for oddities: an unusually large amount, a delivery address far from the usual one, a high-risk merchant category.
Limits. Cap how many BNPL applications one device or identity can make in a period, so a fraudster cannot keep trying until one passes.
Address verification. Shoppers with several addresses are normal. Write a rule for when a new address is acceptable and treat anything outside it as suspicious.
Credit bureau checks. Match the application against the applicant's credit file; the two should agree.
Customer education. Tell customers how to protect their BNPL account and what a phishing attempt looks like.
What merchants should do
Five habits cut most of the risk.
1. Score transactions with a fraud detection tool
Use a tool that scores each transaction from device, network and behaviour signals and flags the suspicious ones before they are approved.
2. Train staff
Staff who know the common BNPL frauds and their signs catch cases the tooling misses.
3. Use a secure payment gateway
Process payments through a secure gateway and keep to the Payment Card Industry Data Security Standard (PCI DSS).
4. Watch return requests
Look for return patterns that point to abuse, such as repeated returns from the same account.
5. Limit transaction amounts for new users
Cap what a new BNPL user can spend until they have a repayment history.
Where BNPL fraud detection is heading
Detection tools lean harder each year on machine learning, behavioural analytics and device fingerprinting, and they get more precise as they learn from more fraud outcomes.
Regulation of BNPL is still developing. Know Your Customer (KYC) and Anti-Money Laundering (AML) requirements are the likely next step, with tighter rules on data security and consumer protection behind them.
Providers that pair those checks with real-time scoring will carry the least fraud.
How Sensfrx helps
[Sensfrx](/) scores every signup, login and payment as it happens, from device, network and behaviour signals. Your rules decide what each score means: allow, review or block.
For BNPL, that gives you the following.
1. Real-time scoring
Each event is scored before the decision is made, so a block stops the order rather than flagging it after the goods have shipped.
2. Behaviour signals
The score takes in how the user behaves against their own history. An account that always logs in from one laptop at the same time of day and then appears from a new device at 3 a.m. scores differently from one that is behaving as usual.
3. Signup scoring
New accounts are scored at signup, which is where new account fraud and synthetic identities enter. It runs alongside whatever KYC your BNPL provider requires and keeps the bulk of fake registrations out before they reach it.
4. Login scoring
Each login is scored on device, network and behaviour. A login from a new device on an unfamiliar network can be sent to review or blocked under your rules, so a stolen password on its own is not enough to take over an account.
5. Decisions before the order completes
Because the score comes back in real time, a risky transaction can be stopped before it is finalised, which is what keeps it from becoming a chargeback.
6. Your rules
You set the thresholds for allow, review and block to match your risk appetite and your product mix.
7. Integration
Plugins for WooCommerce, Shopify, WHMCS, Blesta and WISECP, and a REST API for everything else.
8. One place to review
Transactions held for review are queued with the signals that triggered the hold, so an analyst can decide quickly.
9. Free plan and trial
Sensfrx is self-serve. Start on the free plan or the 14-day trial and score live traffic the same day.
Where to start
BNPL draws new customers and bigger baskets, and it draws fraudsters for the same reason: the goods ship before the money arrives. Every pattern above abuses that gap.
Close it at the three points where the fraudster has to show up: signup, login and payment. Start a free trial and score your next BNPL order before it is approved.