Buy Now, Pay Later Scams: The Hidden Fraud Risks of Installment Payment Apps

Buy now, pay later is everywhere. Klarna is at checkout on your favorite clothing site. Afterpay splits your concert tickets into four easy payments. Affirm just partnered with Costco. The model is frictionless by design, and that's exactly what makes it a target.

BNPL apps now serve more than 380 million users worldwide, and scammers have noticed. The same features that make BNPL convenient (quick approvals, minimal credit checks, and low friction at checkout) are the exact vulnerabilities bad actors exploit. The result is a fast-growing category of fraud that many consumers don't even know to watch for.

Here's what's actually happening inside these apps, and how you can protect yourself.

How BNPL apps work (and why scammers love them)

Buy now, pay later apps function as short-term microloans. You make a purchase, the BNPL provider pays the merchant, and you repay the provider in installments, typically four payments over six weeks. The whole process is built to feel effortless.

That frictionlessness is the point. BNPL providers deliberately strip out security checkpoints to reduce cart abandonment. Fewer verification steps means faster checkouts and more completed sales. But fewer steps also means fewer barriers for fraudsters.

According to Juniper Research, real-time credit decisions, delayed repayment windows, and lightweight identity checks are the three structural vulnerabilities that make BNPL particularly attractive to bad actors. Unlike a bank with decades of fraud-detection infrastructure, many BNPL providers are younger companies whose security systems haven't caught up to the scale of their user bases.

The most common BNPL scams targeting consumers

Account takeover fraud

This is the most common form of BNPL fraud. A scammer gets hold of your login credentials, usually through a phishing email or a data breach, and uses your existing account to place orders. Because your account already has payment history and pre-approval, there's almost no friction. By the time you notice, the items have shipped.

Picture this: you get an email that looks like it's from Klarna, saying there's a problem with your recent payment. You click the link, enter your credentials on a site that looks identical to the real one, and hand your login directly to a scammer. Classic phishing, applied to a newer target.

Synthetic identity fraud

Scammers don't always use real people's identities. Sometimes they build fake ones. Synthetic identity fraud combines real data, like a valid Social Security number scraped from a breach, with fabricated details like a fake name and date of birth. The resulting identity looks legitimate enough to pass BNPL onboarding checks, and the fraudster makes purchases with no intention of repaying.

Experian flagged synthetic identity fraud as one of the top growing risks for BNPL providers. Aite-Novarica Group estimated that synthetic identity fraud losses would reach $2.94 billion in 2024.

New account fraud

Scammers use stolen personal information to create fresh BNPL accounts. Because many BNPL providers don't run hard credit checks, the bar for opening an account is low. A fraudster armed with your name, email, and Social Security number can open an account in minutes and start making purchases before you know anything is wrong.

Phantom debt collectors and fake BNPL notices

This scam operates outside the apps entirely. You receive a text or email claiming you have an outstanding BNPL balance. There's a link to "resolve" the issue. You click it, enter your payment details, and send money directly to a scammer. There is no real debt. The whole thing is a social engineering play built to create urgency and bypass your better judgment.

Why BNPL fraud is harder to spot than credit card fraud

Credit card fraud is familiar. Most people know to check their statements, and banks have decades of experience flagging unusual charges.

BNPL fraud is different in ways that make it easier to miss.

First, BNPL charges don't show up on your credit card statement. They live in a separate app that many people check far less regularly. A fraudster can rack up purchases across several installment windows before the victim ever logs in.

Second, BNPL providers don't always offer the same dispute protections as credit card companies. The Consumer Financial Protection Bureau has specifically flagged the inconsistency of consumer protections across different BNPL services. If something goes wrong, your path to resolution may be less clear than with a traditional card.

Third, the delayed payment structure works against you. Some 4 in 10 BNPL users report paying late on at least one plan in the past year, according to a LendingTree survey cited by CNBC. When attention to payments is already fragmented, spotting unauthorized charges takes even longer.

By the time you notice a charge you don't recognize, the goods have shipped, been resold, and the fraudster has moved on.

How to protect yourself from BNPL fraud

The good news is that protecting yourself doesn't require anything technical. These habits close most of the gaps.

• Check your BNPL accounts regularly. Log in at least once a week, not just when you get a payment reminder. Look for orders or charges you don't recognize.
• Use strong, unique passwords. If your BNPL account shares a password with any other service, change it now. Credential stuffing, using leaked passwords from other breaches to break into accounts, is one of the most common entry points for account takeover fraud.
• Turn on multi-factor authentication. Most major BNPL apps support it. This adds a second verification step, so even if someone has your password, they can't get into your account without your phone.
• Be skeptical of payment notices. If you get a text or email about an outstanding BNPL balance, don't click the link. Go directly to the app or the official website to check. Legitimate BNPL companies don't need you to "verify" your payment details via a link in a text.
• Read the terms before you sign up. Know what fraud protections the provider offers before you share your personal and banking information. Not all BNPL services are equal when it comes to dispute resolution.
• Monitor your personal data. New account fraud uses your information to open accounts in your name. Tools that alert you to new accounts or unusual activity can catch this early, before the damage spreads.

What to do if you've been hit

If you think someone has used your BNPL account without your permission, move fast.

1. Lock or freeze your account through the BNPL app immediately.
2. Report the fraud to the provider's fraud team. Screenshot everything: email addresses, transaction details, timestamps.
3. Change your passwords on the affected account and any account that shared the same credentials.
4. File a report with the FTC at ReportFraud.ftc.gov. If you received a scam text, forward it to 7726 (SPAM) to report it to your carrier.
5. Check your credit reports for any new accounts or hard inquiries you don't recognize. You can get free reports from all three major bureaus at AnnualCreditReport.com.
6. Contact your bank if any payment or banking information was shared with the scammer.

Conclusion

BNPL apps make shopping easier. That's genuinely useful. But the same design choices that make them fast and convenient also make them an attractive target for fraud, and most users don't realize it until something goes wrong.

Staying safe doesn't mean avoiding BNPL entirely. It means treating your BNPL accounts with the same attention you give your bank account: strong passwords, regular check-ins, and a healthy skepticism toward any unsolicited message about money you owe.

If you want a layer of protection that works in the background across your browser and phone, Guardio detects and blocks phishing sites and scam links before you can click them. Get a free security scan with Guardio today and stay protected from the threats hiding inside everyday apps.

Get a free security scan with Guardio today and stay protected