How do bots exploit buy-now-pay-later checkout to run up debt in your name?

The checkout is designed to say yes fast

Buy-now-pay-later is now ordinary. More than 380 million people use it worldwide, and 47 percent of Americans have used it, according to LendingTree's 2026 figures. The usual shape is four payments over six weeks, and the CFPB counted 53.6 million Americans using one of the six largest providers in 2023, up 12 percent on the year before. The product works because approval takes seconds and the customer barely notices the credit check.

That is also why it is a fraud target. Juniper's research on the sector names three structural vulnerabilities: real-time credit decisions that cannot wait for a proper review, delayed repayment that lets the fraud run before anyone notices, and lightweight identity checks at signup. A bot that can pass the light check gets the goods before the lender gets the doubt.

Account takeover is the easy door

The most common BNPL fraud is account takeover, not a fake identity. A bot tests stolen username and password pairs from earlier data breaches against BNPL apps and retailer accounts, and when one works, it has the victim's saved payment methods, purchase history, and credit line. The bot places the order, chooses the split-pay option, and the victim finds out when the second installment fails or the statement arrives.

The defence here is the same one that applies everywhere credentials are reused: unique passwords and two-factor authentication on the account that holds the payment method. A BNPL provider that lets a login succeed from a new device in a new country with no extra check is handing the bot the keys, and some do exactly that to keep signup smooth.

Synthetic identities are the expensive door

The harder version is the synthetic identity: a real Social Security number, often a child's or a deceased person's, combined with an invented name, address, and phone number. The identity has no single victim who notices, because the pieces belong to different people. Aite-Novarica estimated synthetic identity losses at $2.94 billion in 2024, and BNPL is a natural target because the credit lines are small enough to open without triggering the checks a mortgage would.

The synthetic account pays the first installment, because the first installment is the proof of life. Then it stops. The provider chases an address that does not exist and a phone number that was a burner. The goods are resold before the second payment date. The loss sits with the provider, until the provider tightens approval, and then it sits with every legitimate shopper who gets declined.

What actually slows it down

Device and behavior signals help more than document checks. A new account created minutes before a high-value order, a device that has opened a dozen BNPL accounts, an address that matches a freight forwarder: these are the signals that separate a bot from a shopper. Providers that weight them catch the fraud before the goods ship. Providers that weight only the credit score catch it after.

For shoppers, the fix is unglamorous: freeze your credit, use a unique password on every financial account, and check BNPL apps for plans you did not open. For retailers, the fix is to treat split-pay orders like any other high-risk order: hold the shipment on the first order from a new account, and do not let the speed of the checkout set the speed of the fraud review.

Keep reading: Card testing on small checkouts: why the $1 charge is the whole attack, Velocity rules: the five numbers that stop a card testing attack, and The one-dollar hold: why test charges show up on real customers cover the nearby cases in this series.

Frequently asked questions