What Is Buy Now, Pay Later, and Why It’s a Prime Target for Fraudsters?

Quick Hits:

• Buy now, pay later (BNPL) is a payment form allowing customers to purchase items that are repaid in fixed installments.
• Customers can obtain items before they are paid in full.
• From 2021 to 2025, an estimated $206 billion will be lost due to online payment fraud, which includes BNPL.

Buy now, pay later (BNPL) is a type of payment that allows customers to purchase items that are repaid in fixed, smaller interest-free installments. BNPL will enable customers to obtain items before they are paid in full. For example, a young family may not have the funds to purchase a new bedroom set. Instead of waiting to save up for the big purchase or using a credit card that comes with high interest, this family can use the BNPL method to order the furniture immediately and pay it off in fixed monthly installments. As you can imagine, this payment method has become increasingly popular, especially during the pandemic when people relied more heavily on online shopping.

On the other hand, businesses can also benefit from offering BNPL because it can increase sales conversions and profits. Why is that? If more customers can afford a merchant’s products, they will be more likely to make one or more purchases compared to a company that doesn’t offer the same payment flexibility.

Aside from businesses and consumers, cybercriminals are also attracted to the buy now, pay later boom. Since BNPL is still fairly new, there are security risks as businesses and regulations adopt this flexible payment approach. There are various types of buy now, pay later fraud, which includes the following:

• Account Takeover (ATO) Fraud – ATO is the most common type of BNPL fraud, which occurs when a cybercriminal takes over a current BNPL account or a user account with a business that has a BNPL account. Once they gain access, the fraudster can use the account to make unauthorized purchases.
• Fraudulent Chargebacks – A fraudulent chargeback occurs when a customer claims they never made a purchase and requests the BNPL provider to issue a refund to their account. Of course, honest mistakes can happen, such as when an account owner’s child or younger sibling makes a purchase without the owner’s consent (like how Amazon had to shell out up to $70 million in refunds for unauthorized in-app purchases by Amazon customers’ children). This BNPL fraud type can harm a company’s profits since they have to cover chargeback, handling, and processing fees.
• Never-Pays Fraud – Never-pays fraud occurs when cybercriminals create BNPL accounts using stolen identities or hack other users’ accounts and then make large purchases without paying for the items.
• New Accounts Abuse – It’s easy to set up a new BNPL account. Buyers need to submit identification verification, such as their driver’s license, which hackers can easily obtain this information via data breaches, forgery, or phishing emails. Thus, fraudsters can successfully establish new accounts using stolen data and enjoy a default line of credit offered to new users.
• Synthetic Identity Fraud – A $6 billion issue at the enrollment step, cybercriminals use both accurate and fake personal information to establish a new identity. For example, the scammer may use a real Social Security Number and a phony name and address. Since these BNPL accounts have some real data, this synthetic identity fraud can pass as regular consumer activity. If these accounts failed to make payments, the BNPL providers would likely mark it as “bad debt” instead of fraudulent activity.
• Transaction Laundering – BNPL providers are focused on speed and efficiency, which can open up opportunities for transaction laundering. This fraud occurs when undisclosed businesses use approved merchant credentials to make purchases for other secret stores selling illegal products and services.
• Trojan Horse Fraud – When a cybercriminal signs up with a merchant using a BNPL account and then updates their payment method on the merchant’s website to a stolen or illegally obtained card method, this is called trojan horse fraud. Typically, BNPL providers are responsible for chargeback fees, which is why many companies implement minimal fraud defenses for BNPL payments.

In 2021, a woman named Stephanie McDaid from Glasgow, Scotland, experienced BNPL identity fraud. Stephanie’s parents received a Topshop package at their house, her old address, which included a black dress and a £30 bill from the BNPL provider, Klarna. The problem? Stephanie had never used Klarna before, which led her to contact Klarna for answers. A couple of questions later, she discovered that she was an identity fraud victim.

A primary reason why people like Stephanie become victims of this fraud is because of how easy it is for fraudsters to sign up for BNPL services under other people’s names. To use Klarna’s payment services, customers merely have to provide a name, email address, date of birth, phone number, and billing address. Once signed up, users can enjoy payment deferments for up to 30 days. Luckily, Klarna immediately closed the fake account under Stephanie’s name. However, this case still highlights a significant issue with how easy it is for scammers to sign up for and exploit BNPL services.

Earlier this year, fraudsters claiming to be the BNPL provider, Afterpay, sent scam messages to Australian devices (customers and non-customers of Afterpay). The unsolicited texts included fake verification codes. Afterpay reported that no fake accounts were set up, nor was there a data breach due to these scammer texts. However, this incident illustrates the growing risks plaguing the digital financial services industry. Specifically, cybercriminals are targeting buy now, pay later providers because it is easy to establish or steal user accounts and make purchases using compromised or fake personal data.

Businesses have the delicate task of balancing security and user experience. Specifically, they must protect their customers from BNPL fraud and maintain a positive and streamlined payment experience for customers. There are several types of fraud, meaning fraudsters have a variety of ways to strike businesses and customers. Since buy now, pay later services offer an appealing alternative to paying full price or with high-interest credit cards, many companies offering online payments can benefit from this flexibility and convenience that consumers may prefer.

At IXOPAY, our cloud tokenization platform is built to help you collect, store, and transmit sensitive data, including cardholder data. To combat BNPL fraud, merchants can partner with a fraud prevention service and utilize 3-D Secure, a solution that reduces fraud and chargebacks with minimal friction within your payment flow.