When a digital lender added BNPL to their checkout flow, they expected card-fraud to port over roughly intact. What they found instead was a completely different attack shape: a new identity with zero prior spend history, a $480 purchase split into four installments, and an item that ships immediately. The first payment clears. The account then goes quiet until the installment cycle's end, at which point the next three payments fail in sequence.
Their existing velocity rules saw nothing wrong. The authorization amounts were small. The device was unflagged. The email address was a week old but that wasn't a hard block. The fraudster understood the product mechanics better than the risk team did.
BNPL fraud operates on a fundamentally different clock than card fraud. The exploit window is measured in payment cycles, not seconds. That distinction matters enormously for detection, and most card-centric rules engines are built for the wrong timeline.
Why Card Rules Miss BNPL Attack Surface
Card fraud detection was built around a single transaction event: approve or decline now, gather feedback within days. Chargebacks arrive in a predictable window and the loss is bounded to the transaction value.
BNPL fraud exploits the installment structure directly. The product ships on the first payment, often $25 to $100. The remaining three installments, carrying the bulk of the order value, are future obligations the fraudster has no intention of meeting. From the lender's perspective the exposure is created at order time but the loss materializes over a 6-to-8-week cycle.
Standard velocity rules watch for:
- Multiple high-value transactions in a short window
- Repeated failed authorization attempts
- Card numbers appearing across multiple accounts
None of those patterns fire on a single $480 BNPL order placed with a freshly created account. The authorization is low-value per installment, the account is new so there's no prior abuse history, and the card isn't being reused across multiple identities (yet). Card-centric rules are pattern-matching against card fraud behavior applied to a product that doesn't work like a card.
The Temporal Signature of BNPL Exploitation
What BNPL fraud does leave behind is a distinct temporal and behavioral pattern. We've seen it repeat consistently enough to treat it as a fingerprint.
The attack typically looks like this at the account level: identity creation and first purchase happen within 24 to 72 hours of each other. The first installment succeeds. Between the first and second payment dates, the account shows no other activity: no browsing, no support contacts, no address changes. That dormancy is itself a signal. Legitimate BNPL users are often repeat purchasers who log in, check order status, or start a second purchase during the cycle.
Then the second installment attempt fails. Not because of insufficient funds timing, but because the payment method has been updated to a disposable card or the linked bank account has been drained. By the time the third attempt fires, the account is unreachable.
When we mapped this pattern across a set of confirmed BNPL fraud cases at an early-stage payments company in 2024, the lifecycle fit almost exactly. Account age at first purchase was under four days in roughly 70% of confirmed fraud cases. Account dormancy between installment 1 and installment 2 was present in nearly all of them. That dormancy metric doesn't exist in card fraud models at all.
Identity Signals at Onboarding Are the Leverage Point
Because the temporal window between order and loss is weeks long, the only practical place to intervene is at the onboarding or first-purchase moment. Once the product ships, the loss is largely locked in.
This shifts the question from "is this transaction fraudulent" to "is this identity likely to complete the installment cycle." That's a different scoring problem. The relevant signals at onboarding for BNPL are:
Email age and domain pattern. Free-provider email addresses created within 72 hours of the purchase attempt are overrepresented in BNPL fraud. Not dispositive on their own, but worth weighting heavily when combined with other signals.
Address tenure cross-reference. Fraudsters using synthetic or stolen identities frequently supply addresses that are inconsistent with the identity's stated history. A 35-year-old identity with an address that only appears in databases from the past month is worth flagging.
Device and behavioral velocity across identity graph. A device that has been used to onboard three new accounts in the past two weeks, even with different names and emails, is a strong signal. This is where graph-based identity linkage pays off in BNPL contexts specifically: the same device appears at onboarding for multiple accounts, each placing one order before going silent.
Purchase category and shipping profile. Electronics, jewelry, and high-resale-value goods with next-day shipping selected are heavily overrepresented in BNPL fraud. A first-ever purchase of a $450 gaming console with express shipping and a two-day-old account should generate friction regardless of the payment split amount.
The Feedback Loop Problem
One reason BNPL fraud is underweighted in most models is that the labeled data arrives late. Chargeback windows for card fraud are typically 60 to 120 days. BNPL installment failures may not be conclusively resolved as fraud versus financial default for 90 to 150 days, depending on the lender's collections flow.
This delayed labeling creates a training data problem. If you're retraining your model on 30-day feedback windows, BNPL fraud cases aren't labeled yet. They're sitting in a "late payment" queue with ambiguous status. Your model is training on incomplete signal and underestimating BNPL fraud prevalence as a result.
The fix is explicit: label your training pipeline by payment outcome at 90 days, not 30. It's slower feedback, but it's the correct feedback for this product type. We're not saying card-fraud feedback windows are wrong for cards. We're saying applying a 30-day feedback window to an installment product is a category error.
Graph Linkage Across BNPL Accounts
One pattern we see consistently in BNPL fraud rings is shared infrastructure across seemingly independent accounts. A set of fraudulent BNPL accounts created over a 2-week window will often share:
- The same device fingerprint or a rotation of 2 to 3 devices
- IP addresses from the same /24 subnet or the same VPN exit node cluster
- Billing addresses with minor variations (apartment number flipped, slight street name change)
- Similar purchase timestamps relative to account creation
When you look at each account in isolation, none of them look that bad. The velocity is low per account. But when you build the account graph and look at device-to-account and IP-to-account edges, the ring structure is obvious. This is exactly what a real-time graph traversal at scoring time can surface: a new account with a device that has three prior accounts in a "dormant after first installment" state should receive a high-risk score regardless of how clean the account itself looks.
Friction Strategy for BNPL
The practical intervention for high-risk BNPL orders isn't always a hard decline. The economics are different from card fraud because the lender has weeks to catch the problem before the full loss materializes.
For borderline-risk orders, a stepped approach works well: approve the first installment at a lower order cap (say, capped at $150 regardless of order size), hold the remainder pending behavioral verification during the cycle. If the account shows normal engagement patterns over the following week (login, address confirmation, customer service contact), auto-approve the full installment ladder. If the account goes silent immediately after the first authorization, flag for manual review before shipping anything.
This isn't a perfect solution. It adds friction to some legitimate early-stage buyers who happen to be low-engagement. But it's a measured way to reduce loss on the highest-risk segment without blanket declining a product category that's supposed to expand credit access.
What We're Not Saying
We're not saying BNPL is inherently unfixable from a fraud perspective. Lenders who have built installment-aware models with proper temporal features and delayed feedback labeling have managed BNPL fraud rates that are competitive with card fraud rates. The problem isn't structural to the product: it's structural to detection approaches that were designed for a different product and never updated.
Card fraud instincts are good instincts. They just need a different set of temporal features, a different feedback window, and an identity-graph layer that thinks about account graphs rather than individual transaction sequences. The patterns are learnable. The starting point is recognizing that BNPL fraud and card fraud are operating on different timelines and refusing to pretend that the same rules catch both.
