Lending and BNPL Fraud: Typologies, Signals, Controls

Credit products pay out value before the customer has proved they will repay, so every lending journey is a race between the fraudster's speed and the lender's ability to tell intent from risk. Personal loans, credit cards, auto finance, mortgages and buy now pay later (BNPL) all attract the same core attacks: fake or stolen identities, honest identities lying about their circumstances, and insiders or merchants who game the process. This guide sets out the typologies by product, the signals that separate fraud from ordinary credit loss, the controls that work at application, funding and servicing, and how to measure them. It is written for fraud, credit risk and product teams at lenders and BNPL providers, and for merchants and brokers who sit inside the lending flow. It goes deeper than the First-Party Fraud Guide on credit specifically and does not repeat its general material.

Key takeaways

Classify losses before you model them. A loan that never makes its first payment is usually fraud, not credit risk; if it is booked as bad debt, the fraud model never learns from it.
Loan stacking is measurable, and common in BNPL. The CFPB found that 32.6% of BNPL borrowers in 2022 held simultaneous loans from different BNPL firms, a figure it describes as an undercount, while most pay-in-four loans do not appear on credit files.
Merchants and brokers are part of the attack surface. In BNPL, point-of-sale and broker-originated lending, a colluding merchant can manufacture sales, choose the customer data and pocket the funding.
Velocity across channels beats any single check. Many lending fraud schemes only appear when you count applications, devices, bank accounts and addresses across products, partners and a short time window.
Regulation now reaches BNPL in the UK. From 15 July 2026, FCA rules in PS26/1 require deferred payment credit lenders to run a proportionate creditworthiness assessment before each agreement, which also raises the bar on data quality at application.

Lending fraud typologies by product

The same few motives repeat across products, but the mechanics and the moment of loss differ. Agree a taxonomy before you build rules or report numbers.

Product	Common typologies	Moment of loss	Often booked as
Unsecured personal loans	Stolen or synthetic identity, falsified income, loan stacking across lenders in a short window, first payment default	At disbursement to the borrower's bank account	Early credit loss
Credit cards and revolving credit	Synthetic identity bust-out, authorised user piggybacking to build a thin file, account takeover followed by limit increases	When the line is maxed out, often months after opening	Charge-off
BNPL (pay-in-four and short instalment)	Stolen identity or card used to fund instalments, loan stacking across providers, friendly fraud disputes, merchant collusion and fictitious sales	At checkout, when goods ship or the merchant is settled	Missed instalment, dispute loss
Auto finance	Income and employment misrepresentation, straw borrowers, identity theft, dealer inflation of vehicle value or add-ons, vehicle exported or hidden after funding	When the lender funds the dealer	Repossession shortfall
Mortgages	Occupancy fraud, income and asset misrepresentation, straw buyers, appraisal fraud, property flipping, identity theft	At completion, when funds move to the seller or settlement agent	Default, loss on sale
Small business credit	Shell or impersonated businesses, falsified revenue and bank statements, stacking of merchant cash advances	At funding	Business default

FinCEN's mortgage loan fraud assessment, which reviewed suspicious activity reports filed between 1996 and 2006, split the problem in a way that still applies to all lending: fraud for property, where the borrower misrepresents facts to obtain credit for their own use, and fraud for profit, where insiders such as brokers, appraisers or settlement agents take part for money. In its sample, occupancy misrepresentation was the most commonly reported misrepresentation of loan purpose and material misrepresentation of income, employment or assets appeared in about two thirds of the narratives reviewed. Swap "appraiser" for "dealer" or "merchant" and the fraud for profit pattern describes auto and BNPL collusion too.

Who commits it: first party, third party and insider

Third-party identity fraud: an impostor applies with a stolen identity. The real person discovers it through collections contact or a credit file alert. Identity verification, document checks and credit freezes stop much of it. See the Identity Fraud Prevention Guide and the Credit Freezes and Fraud Alerts Guide.
Synthetic identity fraud: the Federal Reserve's recommended definition is the use of a combination of personally identifiable information to fabricate a person or entity for a dishonest act for personal or financial gain. Synthetics are nurtured over months, often with small credit lines, then busted out. There is no real victim to complain, so losses hide in charge-offs. See the Synthetic Identity Fraud Guide.
First-party fraud: the real customer lies about income or employment, stacks loans they cannot repay, never intends to pay, or disputes BNPL purchases they made. Identity checks pass, so detection relies on behaviour and history.
Insider and partner fraud: loan officers, brokers, dealers and merchants who submit fabricated applications, alter documents, recycle customer data or create fictitious sales to collect funding or commission.
Money mule and laundering use: loan proceeds paid into accounts controlled by organised groups, or credit used to move criminal funds. See the Money Mule Detection Guide.

BNPL fraud: what is different

BNPL sits between card payments and lending. Decisions are made in seconds at checkout, amounts are small, and the funding often goes to a merchant rather than the borrower. That shape creates specific weaknesses.

Thin data and invisible exposure

The CFPB's January 2025 report, which matched pay-in-four applications and originations from six BNPL firms to de-identified credit records, found that BNPL lenders generally do not report pay-in-four loans to the three nationwide consumer reporting companies. A lender therefore cannot see how many other BNPL loans an applicant holds. The same report found simultaneous loans from different firms among 31.7% of BNPL borrowers in 2021 and 32.6% in 2022, and that subprime and deep subprime borrowers accounted for 61% of originations in its 2021 to 2022 data. High stacking and low visibility are ideal conditions for both overextended genuine borrowers and deliberate bust-outs. In the UK, PS26/1 requires key product information to say whether the lender will or may obtain information from a credit reference agency, but it does not require lenders to report to one.

Merchant collusion

Where the BNPL provider pays the merchant up front, a corrupt or compromised merchant can:

Manufacture sales: put through orders with stolen, synthetic or recruited customer identities, take the settlement, and never ship goods.
Split and inflate: break one large purchase into several small orders under approval thresholds, or inflate basket values.
Cash out: sell "goods" that are really cash advances to customers who intend to default, taking a cut.
Refund abuse: issue refunds to a different instrument from the one that funded the plan, then leave the BNPL lender chasing an unpaid plan.
Onboard and vanish: sign up as a new merchant, process a burst of high-value orders, then disappear before customers complain or instalments fail. See the Marketplace Seller and Platform Fraud Guide.

Consumer-side BNPL abuse

Stolen card funding: the first instalment is paid with a stolen card, goods ship, and the plan defaults when the card is blocked. Card testing against BNPL checkouts is a related problem. See the Card Testing and Carding Attacks Defence Guide.
Account takeover: criminals log in to a good customer's BNPL account, change the delivery address and spend the existing limit. See the Account Takeover Prevention Guide.
False non-receipt and dispute claims: the customer claims an item never arrived to pause or cancel the plan.

Detection signals by stage

Stage	Signals worth scoring	Data sources
Application	Identity elements that do not belong together (SSN or national ID issued recently relative to age, address with no history), thin file with recent authorised user tradelines, disposable email, VoIP phone, income out of line with occupation or open banking data	Credit bureau, identity verification, consortium, open banking
Velocity	Multiple applications in hours or days across your products, partners or other lenders; same device, IP, bank account, phone or employer across different names	Device intelligence, internal application store, bureau inquiry data, consortium
Documents	Payslips or bank statements with font, metadata or arithmetic inconsistencies; employer phone numbers that route to the applicant; the same document template across unrelated applicants	Document forensics, employment and income verification services
Funding	Disbursement account opened very recently, account name mismatch, change of payout account just before funding, funds moved out within minutes	Account verification, confirmation of payee, transaction monitoring
Merchant and broker	Approval rates, average ticket and early default rates out of line with peers, many orders from the same device or IP, orders just under thresholds, high refund rates to other instruments	Merchant analytics, partner scorecards
Early servicing	First payment default, payment by a card or account in another name, returned direct debit on the first instalment, address change soon after funding, no contact	Servicing system, collections data
Bust-out	Rapid utilisation to the limit across products, cash-like purchases, payments that later fail to inflate available credit, sudden limit increase requests	Card and account data, bureau triggers

A first payment default (no payment ever received on a new loan) and an early payment default (missing an early instalment, often within the first three months) are among the strongest fraud indicators lenders have. Review a sample of them manually and feed confirmed fraud back into application models, rather than leaving them in the credit loss pool.

Controls that work

At application

Layered identity proofing: combine data checks, document and liveness checks for higher-risk applications, and bureau and consortium history. Scale the friction to the risk score rather than applying the same steps to every applicant. The Account Opening and Application Fraud Guide covers the journey design.
Verify income from source: use consented open banking or payroll data instead of uploaded documents where possible. Documents are the easiest thing to forge.
Cross-lender visibility: join fraud data sharing schemes and query them at application. See the Fraud Data Sharing and Consortium Intelligence Guide.
Affordability as a fraud control: a proper creditworthiness assessment exposes stacked debt and income that does not exist. In the UK, PS26/1 requires DPC lenders to apply CONC 5.2A to agreements of any value, including those under £50.

At funding

Pay out only to verified accounts: check the account is in the applicant's name and treat a newly opened payout account as a risk signal.
Hold periods for new channels: delay merchant or dealer settlement for new partners, or hold back a reserve, until performance data exists.
Step-up on payout changes: re-authenticate any change to the disbursement account or delivery address, especially just before funding or shipping.

For merchants, dealers and brokers

Know your merchant: verify the business, its owners and its trading history at onboarding, and re-check on changes of ownership or bank details.
Partner scorecards: rank partners on early default, fraud-confirmed loss, refund and dispute rates; investigate outliers and suspend quickly.
Contractual levers: recourse for fraud-tainted loans, reserves and audit rights, defined in the partner agreement before you need them.

In servicing

Monitor early life closely: first and early payment default reviews, address and contact changes, and failed first instalments.
Bureau and consortium triggers: watch for sudden new credit across lenders after booking.
Separate fraud and collections treatment: a fraud victim whose identity was used must not be chased as a debtor; a first-party fraudster should not get hardship forbearance by default. Document the decision either way.

Implementation roadmap

Agree the taxonomy and relabel history: define first-party, third-party, synthetic, insider and merchant fraud, and review first payment defaults from the last 12 to 24 months to correct labels.
Measure the baseline: fraud loss rate by product, channel and partner; first payment default rate; share of losses confirmed as fraud.
Add velocity and linkage: build a shared store of application attributes (device, phone, email, bank account, address, employer) and score links across names and products.
Pilot new rules in shadow mode: run them silently for four to eight weeks, compare hit rates with confirmed fraud and good-customer impact, then switch on with clear thresholds. Keep the previous rule set ready to restore if approval rates or complaints move sharply.
Bring partners under the same lens: merchant and broker scorecards, reserves for new partners, and a suspension playbook.
Close the loop: feed confirmed outcomes back into models monthly and review false positives with customer service. The Fraud Rules and Machine Learning Models Guide covers model governance.

Decision guidance: small and large lenders

Question	Smaller lender or new BNPL provider	Large lender
Build or buy scoring?	Buy identity, device and consortium services; write a small number of clear rules on top	Own models on internal data, enriched with vendor signals
Where to add friction?	Step-up on high-value, new-device or mismatched-data applications only	Risk-tiered journeys tuned per product and channel
Partner risk	Settlement holds and reserves for all new merchants	Partner scorecards with automated suspension thresholds
Data sharing	Join at least one industry fraud data scheme	Contribute and consume across several schemes and regions

The core trade-off is approval speed against loss. BNPL's value is a near instant decision, so push the heavier checks to where they cost least: before a credit limit is raised, before payout to a new account, and on merchant settlement rather than every checkout.

Measuring it

Fraud loss rate: confirmed fraud losses as a share of originations, by product, channel and partner.
First payment default rate: and the share of those reviewed and confirmed as fraud.
Stacking exposure: share of new borrowers with other recent credit applications or loans visible in bureau or consortium data.
Partner outlier count: merchants or brokers above the early default or dispute threshold, and time to suspend them.
Good customer friction: step-up and decline rates for applicants who later perform well, and abandonment after step-up.
Label lag: time from booking to confirmed fraud label, which limits how fast models can learn.

See the Fraud Metrics and KPIs Guide for definitions and reporting.

Framework mapping

Control area	NIST CSF 2.0	NIST SP 800-53 Rev 5
Fraud risk assessment by product and channel	ID.RA-03 (internal and external threats identified and recorded)	RA-3 Risk Assessment
Identity proofing at application	PR.AA-01 (identities and credentials managed)	IA-12 Identity Proofing
Application, funding and servicing monitoring	DE.CM-09 (monitoring of data and runtime for adverse events)	SI-4 System Monitoring
Investigation of alerts and early defaults	DE.AE-02 (adverse events analysed)	SI-4 System Monitoring
Merchant, broker and dealer risk	GV.SC-07 (third-party risks understood and managed)	RA-3 Risk Assessment

Common failure patterns

Fraud hidden in credit losses: first payment defaults written off as bad debt, so the fraud model is trained on clean-looking data and synthetic bust-outs never get labelled.
Checking each application alone: every application passes on its own; only linking device, bank account and phone across names would show a ring.
Trusting uploaded documents: accepting payslips and bank statements without source verification, when document templates are easy to buy.
Onboarding merchants on growth targets: new merchants settled immediately with no reserve, so a fraudulent merchant can extract funds and vanish within days.
Weak account recovery on BNPL apps: criminals take over good accounts with high limits because login and address changes need no step-up.
Treating victims as debtors: chasing identity theft victims through collections, which causes harm, complaints and regulatory exposure, while the real fraudster is never pursued.

Practitioner checklist

Publish a lending fraud taxonomy and relabel the last 12 to 24 months of first payment defaults.
Track fraud loss, first payment default and stacking exposure by product, channel and partner.
Link applications across names by device, phone, email, bank account, address and employer.
Verify income from source data where consented, and run document forensics where not.
Pay out only to accounts verified in the applicant's name; step up on payout or address changes.
Hold settlement or take reserves for new merchants, dealers and brokers; score them monthly.
Join and query at least one industry fraud data sharing scheme.
Pilot new rules in shadow mode, with a rollback threshold on approvals and complaints.
Separate fraud victim treatment from collections and forbearance, with documented decisions.
UK DPC lenders: confirm creditworthiness and disclosure processes meet PS26/1 from 15 July 2026.

Lending and BNPL Fraud Guide: Typologies, Signals and Controls for Credit Products