How to prevent buy now, pay later (BNPL) fraud

Buy now, pay later turned checkout into a two-tap loan, and the volume is enormous. Its transaction value crossed a third of a trillion dollars in 2024, and Juniper Research expects it to nearly double to $687 billion by 2028. The same frictionless approval that makes it convenient for shoppers makes it convenient for fraud, because the provider ships the goods or the credit now and finds out whether it will be paid later.

BNPL fraud is any fraudulent activity that exploits that pay-later model, and it lands on the merchant and the provider more than the shopper. This guide covers what BNPL fraud is, the main types from account takeover to loan stacking, why the model is so exposed, and how to prevent it, including the device-level signals that catch a fraud ring reusing one machine across many accounts.

Key takeaways

• BNPL fraud exploits the gap between instant approval and delayed payment, so a provider approves and delivers before the loss surfaces.
• The main types are account takeover, new-account and synthetic-identity fraud, loan stacking across accounts and providers, first-party "never pay" default, and friendly-fraud chargebacks.
• BNPL is unusually exposed because approvals are frictionless, credit checks are thin, and the same person can open accounts across several providers with no shared view.
• Preventing it takes layered defense: identity checks at signup, device recognition to link accounts back to a machine, velocity limits, and step-up on unfamiliar devices.

What is BNPL fraud?

BNPL fraud is any fraudulent activity that abuses a buy now, pay later service, where a shopper splits a purchase into installments or defers payment while the merchant is paid up front by the provider. Because the provider fronts the money and collects later, the fraud is a timing attack: the goods or credit move now, and the bad debt or dispute arrives weeks later, by which point the fraudster is gone.

It sits across two victims. A consumer-facing side involves fake stores and phishing that trick shoppers into handing over payment details on a bogus "pay in 4" checkout. The side this guide focuses on is the merchant and provider side: fraud that targets the BNPL account and the approval process itself, where the losses land on the business extending the credit. Those are the losses a fraud team can actually design against. The stakes have drawn regulators in as well: in 2021 the CFPB opened an inquiry into buy now, pay later credit, citing the model's rapid growth and thin consumer protections.

The main types of BNPL fraud

BNPL fraud is not one attack. The tactics that hit providers and merchants cluster into five recognizable types:

• Account takeover. A fraudster hijacks an existing BNPL account, changes the shipping address, and spends against a credit line the real owner already built. Because the account is established and trusted, these purchases sail through. This is ordinary account takeover aimed at a wallet with a standing line of credit.
• New-account and synthetic-identity fraud. Attackers open fresh accounts using stolen or stitched-together identities, real details mixed with fabricated ones, to pass onboarding and draw credit they never repay. The scale is large: the 2026 Javelin Identity Fraud Study put traditional identity-fraud losses at $27.3 billion in 2025, affecting 18 million victims. Thin verification at signup is what makes this cheap at scale.
• Loan stacking. One person opens many accounts, often across several BNPL providers at once, to draw far more credit than any single provider would approve. No provider sees the whole picture, so each approves its slice. This is multi-accounting applied to credit lines.
• First-party, or "never pay," fraud. A real applicant with real details takes the first installment's goods and never intends to pay the rest, showing up as a first-payment default. A patient version, sometimes called a Trojan-horse attack, makes a few small on-time payments first to earn a higher limit, then defaults on one large purchase. US regulators have flagged the risk directly: in 2023 an OCC bulletin warned that BNPL structures can carry higher first-payment-default risk from intentional fraud.
• Friendly-fraud chargebacks. A genuine customer disputes a BNPL purchase they actually made, recovering the money while keeping the goods, the same friendly fraud that plagues card payments, now on installment rails.

Why BNPL is especially exposed to fraud

BNPL is not more fraud-prone by accident. Its whole value proposition, speed and ease, is the same thing an attacker exploits. Four properties stack the deck:

• Frictionless approval. The product wins by approving in seconds with minimal input. Every check removed for the shopper's convenience is a check removed for the fraudster too.
• Delayed payment. The provider delivers value before the first payment clears, so there is a built-in window where a loss is already incurred but not yet visible.
• Thin credit checks. Many BNPL flows use a soft check or none, so a synthetic or freshly stolen identity has less to trip over than it would at a bank.
• No shared view across providers. Because a shopper can hold accounts at several providers, one person can stack credit that no single provider would grant, and none of them see the others.

Put together, these turn BNPL into a fast, low-friction way to convert a stolen or fabricated identity into real goods before anyone reconciles the books.

How to prevent BNPL fraud

There is no single control that stops BNPL fraud, because the types are different problems. Prevention is layered, and the goal is to add friction exactly where risk is high while keeping the frictionless path for the majority of honest shoppers:

• Verify identity at signup. Real identity checks at onboarding, sized to the credit at stake, are the first filter against synthetic and stolen identities. Pairing them with address and payment-detail consistency checks catches the mismatches a changed shipping address or a recycled card leaves behind. This is the layer a device signal supports rather than replaces.
• Recognize the device behind each account. A persistent device identifier links a new signup or a checkout back to a machine you have seen before, which is how you catch one device quietly opening account after account for loan stacking, and how you spot a login from a device an account has never used.
• Watch velocity across accounts. Many applications, addresses, or cards converging on one device or one connection in a short window is a strong ring signal, even when each identity looks clean on its own.
• Step up on unfamiliar signals. When a login or a high-value purchase comes from a new device, or from a familiar account suddenly on an anonymized connection, route it to a stronger check instead of approving silently. Device recognition is what makes device-based step-up possible.
• Monitor first-payment behavior. First-payment defaults clustered on shared devices or recycled details separate deliberate "never pay" fraud from ordinary missed payments, so you can tune approvals for the accounts that look engineered.

None of these should block the honest majority. The point is to reserve the extra scrutiny for the signals that actually look like fraud, and to base that scrutiny on evidence the identity alone never carried.

Preventing BNPL fraud with ShieldLabs

ShieldLabs gives a BNPL provider or merchant the device layer under those controls. You add one JavaScript snippet to your signup and checkout pages, tie it to your account IDs, and each visit returns persistent identification that recognizes a returning device even after cleared cookies and a rotated IP, alongside a risk score from 0 to 100 with the named signals behind it.

We ran a batch of signups the way a loan-stacking ring would, opening account after account from one machine while emptying the cookie jar and moving to a new IP between each, and the device identifier kept tying them back to the same device. That is the multi-accounting shape underneath loan stacking, and it held up even as every account presented a fresh email and a clean-looking connection. It survives those resets because the identifier is read from the device on each visit, not pulled from the third-party cookie that browsers like Safari began blocking by default in 2020.

That identifier is what surfaces the patterns behind BNPL fraud. When many accounts open from a single device, ShieldLabs recognizes the shared machine, which is the multi-accounting pattern that drives loan stacking. When a login arrives from a device an account has never used, or a checkout runs over a VPN, proxy, or anti-detect browser, the anonymity signals flag it as worth a closer look. ShieldLabs scores the session and names the evidence, while identity verification and creditworthiness stay with your credit and KYC stack. You read the score and the named signals through the API and webhooks and decide, by your own rules, which applications to approve, review, or step up, so the lending decision stays in your system. The free tier covers your first 5,000 identifications.

Sources

1. Juniper Research: BNPL Transaction Value to Rise 106% Globally by 2028 (2024)
2. Office of the Comptroller of the Currency: Bulletin 2023-37, Retail Lending: Risk Management of Buy Now, Pay Later Lending (2023)
3. Consumer Financial Protection Bureau: Inquiry into Buy Now, Pay Later Credit
4. Wikipedia: Buy now, pay later
5. Wikipedia: Synthetic identity theft
6. Javelin Strategy & Research: 2026 Identity Fraud Study: The Illusion of Progress (2026)