‘Criminals love buy now, pay later’: How fraudsters exploit popular interest-free payment plans

LONDON — Buy now, pay later services aren’t just popular among consumers. They’re also proving to be a hit with criminals.

Fraudulent activity is on the rise at some of the largest buy now, pay later (BNPL) platforms in the industry, which include Klarna, Afterpay and Affirm, according to fraud experts who spoke with CNBC.

BNPL products let shoppers split the cost of their purchases over three or four months, often interest-free. They’ve become massively popular in the U.S. and Europe, and generated almost $100 billion in transactions globally in 2020 alone.

“Criminals love buy now, pay later,” Martin Rehak, CEO and co-founder of Czech fraud detection start-up Resistant AI, told CNBC. “You can already see crime on multiple levels.”

Criminal gangs are exploiting weaknesses in the application process for BNPL loans, experts say, using clever tactics to slip through undetected and steal items ranging from pizza and booze to video game consoles.

One of the vulnerabilities, Rehak says, is BNPL firms’ reliance on data for approving new clients. Many companies in the industry don’t conduct formal credit checks, instead using internal algorithms to determine creditworthiness based on the information they have available to them.

Retailers working with BNPL platforms “categorize things differently,” Rehak said, adding that this can lead to inconsistency. “There is always a way to exploit this and basically steal from you using someone else’s mistake.”

For example, a partner merchant may run a special promotion event for alcohol but assign a vague category like “special event.” This runs the risk of fraud falling through the cracks if an artificial intelligence system doesn’t recognize the category and gives it a more generic label with low default risk.

Rehak said many scammers are stealing people’s identities or taking over their accounts to evade detection, making unsuspecting victims foot the bill. He declined to name any specific companies being targeted, however, saying Resistant AI counts a number of BNPL businesses as clients.

Kevin Gosschalk, founder and CEO of American fraud-prevention start-up Arkose Labs, said criminals are increasingly targeting BNPL platforms as they have “softer” controls than the big banks and credit card companies.

“Fintechs are very lucrative because they’re typically fast-growing, early-stage companies,” he told CNBC. “They have much lower controls than the big banks that have been around for many years on the security side, so it makes them a good target.”

Klarna refuted claims that its fraud checks and controls were more lax than that of banks, while Afterpay said it has “extensive back-end fraud processes” in place to verify new users.

Gosschalk said scammers in the U.S. are using such services to exploit supply shortages. He gave the example of criminals getting PlayStation 5 consoles on BNPL and flipping them at much higher prices online to make a profit.

Because BNPL services let users spread their purchases across four equal installments, fraudsters are able to pay just 25% base value — about $125 for a PS5 — and avoid paying back the rest, Arkose Labs’ CEO said.

Arkose Labs says its main clientele consists of financial institutions, tech giants and video game companies. The firm’s customers include the likes of Microsoft and PayPal, the latter of which offers its own BNPL product.

Experts say another reason BNPL systems are being targeted is their popularity — it’s much easier to go unnoticed when there’s a sea of other people applying for credit.

“If you want to survive in the payments business, you must grow very quickly,” Rehak said.

And it’s not just individuals who are working to defraud these services, according to Rehak. Criminals are also enlisting the help of others to cheat the system, offering their know-how to commit fraud at scale.

Warnings of BNPL fraud are particularly timely as Black Friday kicks off the critical holiday shopping season next week.

“There’s going to be a huge amount of fraud hidden in there because they always lower their security checks during those events because they don’t want it to impact sales,” Gottchalk said.

Unlike credit card companies, the bulk of BNPL companies’ revenue comes from merchants. Companies like Klarna and Afterpay charge retailers a small fee on all transactions processed through their platforms.

The key selling point for merchants is that they often see their sales volumes increase as a result. This has led to concerns that BNPL plans are encouraging consumers to live beyond their means.

Retailers are usually happy to accept some level of fraud as the price of doing business, Gottchalk said.

Alex Marsh, Klarna’s U.K. chief, said the firm conducts “advanced and extensive checks internally and externally.”

“These comments based on observations of other BNPL firms do not bear any resemblance to Klarna’s business or fraud prevention capabilities,” Marsh said. “Our fraud rates are half that of credit card fraud and we have far more sophisticated technology in our checkout and products than the banks and credit card issuers.

“We work closer with merchants than the average bank or credit card issuer which means we get a richer level of product data to put in place stronger and more dynamic  protections than outdated payment methods such as credit cards.”

Afterpay said managing fraud was a “top priority” for the company and that losses as a result of fraud accounted for less than 1% of its global sales in the last financial year.

“Our risk management system is based on market-leading proprietary machine learning algorithms that are constantly adjusted to counteract any potential threats,” Rich Bayer, U.K. country manager for Clearpay, Afterpay’s international division, told CNBC.

“Our global risk team is very close to any potential attack or loss abnormality and reacts fast to keep both our customers and merchants safe at all times.”

The BNPL sector has attracted interest from major corporations, with companies from PayPal and Square jostling to play a role in the space. PayPal started offering its own BNPL feature last year, while Square recently agreed to acquire Afterpay for $29 billion.

At the same time, the rapid growth of the industry is worrying regulators. The U.K. government wants to bring BNPL products under regulatory oversight, and is currently running a consultation to determine how to move forward with its plans.

For their part, BNPL platforms like Klarna and Afterpay say they would welcome regulation so long as it’s “proportionate.”