What happens when buy online, pickup in store is used without stronger identity checks?

Why BOPIS Becomes Risky Without Stronger Identity Checks

Buy online, pickup in store is convenient because it shifts some fraud controls from the checkout screen to the pickup counter. That also means the order can be legitimate at creation time but still be stolen, redirected, or claimed by the wrong person later. The weak point is usually not the payment flow alone, but the handoff between order placement, account control, and physical collection.

When stronger identity checks are missing, the pickup process can trust whatever details were last attached to the order. That makes it easier for an attacker with stolen credentials, a compromised email inbox, or access to a payment instrument to alter pickup names, contact details, or collection instructions before the customer notices.

A broader identity and access guide is useful here because BOPIS fraud often depends on the same control failures seen in account compromise, weak verification, and poor lifecycle discipline. The important question is not whether the order exists, but whether the store can prove the person at pickup is the person entitled to receive it.

Where the Fraud Path Usually Opens

The most common failure is assuming that possession of the order number, phone number, or confirmation email is enough. Those artefacts are easy to forward, intercept, or recreate. If staff rely on those alone, an attacker can exploit the pickup channel even when the payment itself was not directly compromised at the counter.

Another weak point is customer account takeover. Once an attacker controls the account, they may change the pickup store, swap the pickup name, or add alternate contact details to make the order appear routine. The fraud is then hidden inside ordinary order-management behaviour, which is why basic order status checks often miss it.

Stronger assurance usually comes from combining multiple signals, for example matching a government ID, a one-time pickup code, or a verified account attribute. The control matters because no single weak signal should be able to unlock physical goods. That same pattern appears in NIST SP 800-63 Digital Identity Guidelines, which emphasise stronger authentication and verification when the consequence of mistaken access is material.

What Good Controls Change at the Store and Account Level

In practice, the strongest BOPIS controls narrow the gap between digital order creation and physical release. The store process should verify that the pickup record, the presented identity, and the release event all align, while the account system should alert on suspicious edits to pickup details, address fields, or contact methods shortly after order creation.

This is also where fraud monitoring becomes important. If a customer suddenly changes pickup location, adds a new phone number, or repeatedly tries different pickup methods, those are not harmless convenience signals. They are indicators that the order may have been re-targeted, and they should trigger extra review before the merchandise is handed over.

For a control-oriented view, the relevant issue is least privilege over pickup rights, not just checkout authentication. The order should be releasable only under conditions that reflect the item value, fraud profile, and the store's ability to verify the collector. That operational mindset aligns with NIST SP 800-53 Rev 5 Security and Privacy Controls, especially the access control, identification, authentication, and audit expectations that support transaction integrity.

Risk and Threat Considerations

BOPIS is attractive to attackers because it converts account access into a physical pickup event, which can be harder for merchants to reverse than a payment dispute. The risk grows when store staff are pressured to move quickly, because fast-service habits often weaken verification at the exact point where fraud becomes visible.

Failure mechanism: The control fails when the pickup process trusts weak identifiers, such as order numbers, email access, or self-declared names, instead of verifying that the collector is entitled to receive the goods. Account compromise then becomes enough to redirect the pickup flow.

Impact: The result can be stolen merchandise, customer disputes, payment fraud, chargebacks, and repeated abuse of the same customer account or store process. At scale, weak pickup controls can turn a convenience feature into a repeatable fraud channel.

Practitioner Guidance

What to verify: Treat the pickup handoff as a separate control point from checkout. Verify which combination of signals actually proves entitlement in your environment, then test it against account takeover, forwarded email, and altered contact-detail scenarios.

Decision rule: If the order value is high, the item is resellable, or the account recently changed pickup details, require stronger pickup verification and manual exception handling rather than relying on a confirmation code alone.

Practitioner takeaway: The key judgement is that BOPIS fraud is usually a handoff problem, so the controls that matter most are the ones that stop a valid order from becoming an invalid pickup.

Related resources from NHI Mgmt Group

• What happens when QR code authentication is used without stronger identity assurance controls?
• What happens when users store cryptocurrency in online wallets or exchanges without stronger controls?
• What happens when online identity verification relies on selfie capture without additional checks?
• What breaks when eSIM activation is automated without stronger identity checks?