Fraud Protection & Compliance
This headline a year ago left me scratching my head: “How buy now, pay later became a $100 billion industry.” As it happens, buy now, pay later (BNPL) breached the $100 billion in mark in 2020 and soared to $157 billion in 2021, according to FICO partner Worldpay. Even more dramatic, PayPal, a relatively late arrival to the party, saw its BNPL volumes soar 226% year over year.
As payments professionals well know, change creates opportunities for fraud.
As BNPL continues to grow, I thought it would be good to examine the state of affairs for BNPL providers, as well as the latest measures to regulate its runaway growth and clamp down on fraud.
What’s BNPL and Who’s Using It?
In case you’ve been living under a rock since the pandemic began, BNPL plans, also known as point-of-sale loans, let shoppers pay for their items over a period of installments, usually four equal payments. As ecommerce boomed during lockdowns, providers like Klarna, Affirm and Afterpay made BNPL a very trendy way to access credit, usually without a credit check. Plain and simple, BNPL is on fire in key markets such as North America and Europe.
One of the reasons why BNPL has got me scratching my head (“OK, Boomer”) is that I’m outside of its key demographics. BNPL financing is most common among people ages 18-24 and 35-44. Generally, younger age brackets tend to use BNPL more often. The income demographic most likely to use buy now, pay later is $50,000-$74,999, although 41% of those in the $100,000+ income bracket use BNPL, too.
What’s really surprising is how popular BNPL plans are. Ascent, a Motley Fool service, found that Americans between 35 and 44 years of age are most likely to use BNPL more than once a week. Those over 54 are most likely to use BNPL once a year or less. Roughly twice as many male consumers use a buy now, pay later service more than once a week compared to female consumers (9% versus 5%).
Late Payments Are Common
Perhaps because it’s so easy to secure BNPL financing – it’s available on the spot, at point of purchase online or in-store – some customers don’t appear to think through the impact of multiple BNPL payments on their budget.
That impact can be profound. The Ascent survey found that 33% of BNPL users have made a late payment or incurred a late fee. Consumers aged 18 to 24 are the most likely to be tardy, with 48% being late and/or being assessed a fee. Moreover, 17% of consumers say they're "very likely" to be late with a BNPL payment over the next 12 months, and 18% say they're "likely" to be late within the year.
Collectively, late payments and rising interest rates are likely going to put a squeeze on the 100-plus BNPL firms operating globally. So is regulation.
Regulation Is Coming for US BNPL firms
In December 2021, the U.S. Consumer Financial Protection Bureau (CFPB) announced that it would investigate the BNPL industry. On September 15 the CFPB issued a report suggesting that BNPL companies must be subjected to stricter oversight, a step toward regulation.
Agency officials say the bureau plans to issue guidance to oversee BNPL vendors and have them complete “supervisory” exams in line with credit card company reporting requirements. TechCrunch reports:
"In the course of its investigation, the CFPB said that it found BNPL vendors are approving more customers for loans — 73% in 2021 compared with 69% in 2020 — and that delinquencies on these services are rising sharply. Meanwhile, the BNPL industry’s charge-off rate, or the rate of uncollectible loans, was 2.39% in 2021 — up from 1.83% in 2020.
"Late fees are also climbing. The CFPB found that 10.5% of customers were charged at least one BNPL late fee in 2021 versus 7.8% in 2020."
Consumer Danger
The CFPB outlined the other dangers of BNPL offerings, including data harvesting and taking on multiple large loans at once. The latter will likely become more acute as people begin to use BNPL for routine expenses, the agency said; the CFPB found that BNPL customers are increasingly paying for purchases like groceries and gas, spurred by macroeconomic pressures, including inflation.
On the other hand, a DebtHammer poll showed that 32% of customers skip out on paying rent, utilities or child support to make their BNPL payments, and BNPL services can also lead to bigger purchases. In May, with the headline “'Buy now, pay later' is sending the TikTok generation spiraling into debt, popularized by San Francisco tech firms,” SFGate reported that the average Affirm customer spends $365 on a single purchase as opposed to the $100 average cart size recorded in 2020. Affirm’s interest rate charge can range from 0-36% APR.
Meanwhile … BNPL Fraud Is on the Rise
BNPL is unlike other credit purchases because payments are typically spread across four transactions. For fraudsters, this translates into an expanded attack surface and thus more opportunities. Two types of fraud commonly occur in the BNPL space; neither is new, but both are flourishing in this yet-to-be-regulated payment form.
Synthetic identity fraud is a popular tactic; fraudsters cobble together synthetic identities from fragments of real identities to secure BNPL financing. With this form of application fraud, criminals receive the “purchased” merchandise immediately and have no intention of making the BNPL payments.
Here’s how pervasive synthetic identity fraud is in BNPL: A new study reported in PYMNTS found that of US consumers surveyed who’d been victims of application fraud, 23% had their information used to open a BNPL account in 2021. BNPL is a popular target because of the high volume of activity (read: opportunities) and because providers are chasing revenue without investing in the same controls that more established financial players, such as traditional card providers and banks, have in place.
Synthetic identity fraud is also occurring at scale, with the potential to perpetrate exponentially more BNPL fraud. FICO’s EMEA general manager Matt Cox recently blogged:
"Another rapidly rising phenomenon that has been highlighted by financial services organizations as even more challenging to identify and address than identity theft is synthetic fraud. It’s driving a new wave of fraud rings that are fabricating hundreds of thousands of identities to apply for new accounts or credit lines, then using them to steal or move money before embarking on other types of fraud. The threat from synthetic identity fraud is amplified as the number of identities that can be created is virtually unlimited and there is no real person that owns the identity who could spot and report the misuse."
Account takeover (ATO) fraud is also using BNPL as an easy gateway. It occurs when a criminal gets ahold of a BNPL user’s login, either by duping them into revealing it (social engineering) or by buying it on the dark web. FICO’s ATO maven Sarah Rutherford explains:
"The dark web offers a marketplace for the data stolen in data breaches and 2021 made it a record-breaking year with significant data breaches around the world, leading to the loss of many millions of personal records.
"The data available for purchase on the dark web can be very rich; personal information such as date of birth, email address, Social Security number / national ID and phone number are sold alongside account specific information such as usernames and passwords. As people frequently use the same passwords across multiple accounts, the theft of one account’s information can make all their accounts vulnerable."
Once the fraudster logs into a legitimate person’s BNPL account, they can start buying just about anything. The victim whose account has been exploited to make these purchases doesn’t know what happened until the loans come due weeks or months later.
What’s Next for BNPL?
With the CFPB’s latest action, it’s clear that BNPL firms are much closer to regulatory oversight. This will likely push fintechs to adopt many aspects of maturity that banks and other financial institutions have long had around issuing credit.
It may also spur fintechs to put into place market-proven solutions for detecting all types of fraud, including synthetic identity-driven application fraud and account takeover. If that’s the case, they know who to call: FICO.
How FICO Can Help You Spot and Stop Fraud Across Your Portfolios
- Learn how our responsible AI helps drive innovation in our fraud detection and prevention solutions.
- Read more about the impact of synthetic identity fraud in application fraud.
- Discover how account takeover (ATO) fraud is hurting both banks and consumers, and what you can do to stop it.
Follow my latest thoughts on fraud, financial crime and FICO’s entire family of software solutions on Twitter @FraudBird.
