When BNPL payers can't pay, who picks up the bill?

• Genuine hardship, synthetic identity fraud, account takeover and first-party fraud all show up as a missed payment, and each one needs a different response.

• Inconsistent credit bureau reporting means a provider often has no idea how many repayment plans a customer already holds elsewhere.

• BNPL providers usually carry the first loss, but merchants and issuers can end up exposed depending on the type of fraud and what their agreement says.

• With the credit file only telling part of the story, behavioral data, device intelligence and network-level insights are increasingly doing the work instead.

• As BNPL moves into higher-value purchases, approving the wrong customer costs more.

Don't have time to read more now? Sign up to our newsletter to get the latest insights directly in your inbox. 

…A customer buys a sofa using Buy Now, Pay Later, books a holiday through a different BNPL provider later that day, then spreads the cost of a new laptop with a third the following morning. 

Each provider checks the application, decides the risk looks acceptable and approves the purchase - but none of them can see the other two. Every one of those decisions was reasonable based on the information available…the problem, however is the information itself.

This is the uncomfortable starting point for BNPL fraud risk: if the system can't see a customer legitimately stacking three repayment plans, it’s even less likely to see one deliberately exploiting those gaps.

And that risk doesn't disappear just because nobody has the full picture. When customers stop paying, whether it's genuine financial difficulty or deliberate misuse, somebody still ends up covering the loss. The question is who.

That's what we’re looking at here: how BNPL losses actually happen, why they're so hard to spot coming, where the cost ends up landing, and what credit teams can do about it in the meantime.

From the outside, missed BNPL payments can look the same: an installment isn't paid and a loss needs to be managed. But the cause behind that missed payment changes everything, and treating all non-payment as one category can mean the wrong team ends up trying to solve the wrong problem.

This is the scenario most people are familiar with. A real customer, in real financial difficulty, who reaches a point where they can’t make their next payment. It’s not a fraud issue, but it still needs managing in the same way as other forms of consumer credit risk.

A synthetic identity gets built from a mix of real and made-up details, just enough to pass onboarding checks, but with no actual person behind it who can be chased for the money. The first payment often goes through fine, which is exactly what makes this one so hard to catch because everything looks like a genuine customer at the start.

In an account takeover scenario, the original underwriting decision may have been completely accurate. The problem is that someone else is now using an existing account, payment method or credit limit without the customer's permission, and the provider isn't making a new risk decision at the point where the fraud happens. Whatever signals made that customer look trustworthy the first time round are now working against the provider.

This is where BNPL fraud and credit risk start to overlap. The customer is real, the identity is genuine and the transaction can look legitimate, but they simply have no intention of paying. On paper, it looks identical to genuine hardship, right up until you see the same pattern show up across two or three other providers at once.

These different scenarios show why BNPL risks can't be treated as one single problem. Get the cause wrong, and you can end up applying the wrong approach to the wrong type of loss.

Here's what makes BNPL exposure difficult to manage: even providers that want to spot it are working with incomplete information.

A customer's BNPL payment history only helps other providers if that information is reported to the credit bureaus, but unlike traditional credit products, BNPL reporting isn't consistent across the market. Some providers report their activity, some only report certain types of plans, and some don't report it at all.

Affirm currently reports its full range of BNPL plans, including Pay in 4, to Experian and TransUnion. Klarna reports longer-term monthly financing but keeps Pay in 4 off the credit file entirely, and Afterpay doesn’t report Pay in 4 repayments either.

Even when BNPL data does reach a credit bureau, there's another gap: it doesn't always feed into the credit scores lenders use when making decisions.

FICO announced new scores built to handle BNPL in June 2025, but they need BNPL data to work - which brings us back to our original problem: not enough providers are reporting for the scores to be useful yet.

One part of the picture does show up: if a customer stops paying and the account goes to a collections agency, the agency reports it, and it lands on the credit file. On-time BNPL payments never do, so the only BNPL behavior other lenders reliably see is a customer who has already defaulted - and by then they've usually stacked several more plans elsewhere. 

The result is that two customers who borrowed the same amount and repaid in the same way can look completely different on paper, simply because they used different BNPL providers.

Some providers have stopped waiting for the bureaus. Open banking lets them look at the account directly, with the customer's permission: what's coming in, what's going out, what's already committed each month. It won't show a plan held with a provider that reports nothing, but it does answer a more useful question - can this customer absorb another payment right now?

Whatever causes a BNPL payment to fail, the outcome is the same: someone in the payment chain has to absorb the loss.

In most cases, this is where the first loss sits. The provider pays the merchant upfront, usually within days of the purchase, then collects the installments from the customer over the following weeks or months. That gap between the merchant being paid and the customer completing their repayments is what makes the model work, but it also means the provider is carrying the risk from the moment the transaction is approved.

If the customer defaults, or the account turns out to be linked to a synthetic identity, the provider takes the hit - with that exposure ultimately reflected in the fees charged to merchants.

Merchants are usually protected from the customer's missed repayments, but they aren't removed from the risk entirely. Disputes over goods that never arrived, or orders that were placed fraudulently, still come back to the merchant, depending on the agreement they have with the BNPL provider.

Merchants that run their own installment plans sit in a different position altogether. Without a third-party provider taking on the credit risk, the exposure stays with the business itself.

The card used to fund a BNPL payment adds another layer to the payment flow. If an installment payment is later disputed, or the card itself was compromised, the issuer is drawn into a transaction it had no part in underwriting.

BNPL risk follows the payment journey across the ecosystem.

Regulation adds another layer of complexity. In the US, there is still no single federal framework defining exactly how BNPL risk and liability should be handled. The CFPB issued an interpretive rule that would have brought BNPL lenders under existing credit card protections, then withdrew it and confirmed it doesn't intend to reissue it. Individual states have started filling the gap instead, with New York publishing proposed rules in March 2026 that would require BNPL providers to register.

That means liability is still largely determined by the commercial agreements between providers, merchants and other partners - deal by deal.

If the credit file doesn't provide the full picture, and open banking only fills part of it, providers need other ways to understand risk and prevent BNPL fraud before it reaches the approval decision. This is where BNPL technology is starting to fill some of those gaps:

• Behavioral and device signals can provide insight during the payment journey itself, using patterns like how someone interacts with the app or device they're using rather than relying only on traditional credit data.

• Consortium and network-level intelligence helps providers spot patterns across a wider ecosystem. By sharing insights between providers and partners, rather than relying only on credit bureau data, it can help address some of the visibility gaps created by inconsistent BNPL reporting.

• AI underwriting can analyze far more signals than manual reviews ever could, helping providers make faster and more informed decisions and spot patterns that might otherwise be missed. The challenge, however, is ensuring those decisions remain explainable when a customer or regulator needs to understand why a decision was made.

• Risk-based step-up checks add extra verification only when the signals suggest it’s needed. This is where BNPL fraud prevention has to be carefully balanced, protecting the frictionless checkout experience that made BNPL successful without adding unnecessary barriers for every customer.

Underneath all of it sits a bigger question: are fraud and payment signals sitting in one decisioning layer, or scattered across three? This is where orchestration becomes important, connecting payment stack components through a single layer so businesses can make better use of the information flowing through their ecosystem, without needing to piece everything together manually.

The latest buy now pay later trends are putting more pressure on the systems behind BNPL, especially when it comes to understanding risk and managing exposure.

The average transaction size is increasing. BNPL started with smaller purchases like clothing and electronics, but it’s increasingly being used for travel, furniture and healthcare. As the value of each transaction rises, the cost of getting a risk decision wrong rises with it.

Reporting is likely to become more consistent over time, whether that happens through industry decisions or regulation. That should give providers a clearer picture of customer commitments, but it also means exposure that was previously hidden starts showing up in decisions - including on customers who have already been approved.

Regulation is moving at different speeds across different markets too. For providers operating across multiple markets, that means managing a mix of requirements rather than following one clear set of rules.

And the checkout experience itself is changing. As more transactions happen through apps, wallets and agentic journeys, the window to assess risk is getting smaller, or disappearing altogether. That makes having the right signals available, and being able to use them effectively, even more important.

None of this is solved by waiting for the credit bureaus to catch up, but there are things providers and merchants can do with the information they already have.

1. Start by separating the types of loss - Missed payments often get grouped together, but genuine financial difficulty, synthetic identity fraud, account takeover and first-party fraud are different problems. Understanding your mix shows where losses are coming from and which teams or tools should be focused on each one.

2. Look at what your systems can actually use - When credit bureau data only tells part of the story, the next question is what other signals are available to you. Some systems rely mainly on bureau data, while others can incorporate behavioral signals, device information and fraud intelligence from across the payment journey. Knowing what your current setup can support is the first step toward improving it.

3. Be deliberate about data sharing - Reporting activity to credit bureaus is becoming an increasingly important part of the conversation, but there's still no single approach across the industry. Understanding the trade-offs and making that decision intentionally will help you prepare for where the market is heading.

4. Understand where liability sits - The business that approves a BNPL transaction isn't always the only one exposed when something goes wrong. Reviewing your merchant agreements and payment flows upfront makes it easier to see who owns what risk before a dispute happens.

Everyone does, in some proportion. But in a market with no shared visibility, the cost tends to land with whoever had the least complete picture at the point of approval. Until BNPL data becomes more consistent across the industry, credit teams need to design around the gaps rather than wait for them to close.

That starts with making the most of the information already available. Most providers have access to more signals than the credit file alone can provide, but those insights are often spread across separate fraud, risk and payment systems that don't naturally share information. 

Aevi’s payment orchestration platform helps bring those systems together through a single layer, so businesses can manage their payment stack more effectively and make decisions with better visibility. It won't solve every visibility challenge overnight, but it can help ensure decisions are based on the strongest picture available.

Want to talk through how BNPL decisions are made across your payment stack? Get in touch with the team today.