Buy-Now-Pay-Later Account Takeover
Scammers phish or hijack your buy-now-pay-later account to make purchases in your name, or open BNPL plans using your stolen identity.
Think a message like this reached you? You can check it right now.
What this scam is
Buy-now-pay-later services (Klarna, Afterpay, Affirm) let people split purchases into installments. Scammers phish your BNPL or linked email/bank login, or use stolen identity data to open BNPL plans in your name and buy goods, leaving you with the bills. Phishing texts about a 'payment issue' or 'new order' are common entry points. Because BNPL sign-up can be quick, it is attractive for identity misuse.
What it usually looks like
- A BNPL 'payment failed' or 'new order' phishing message.
- A login page mimicking Klarna/Afterpay/Affirm.
- Unexpected BNPL orders or accounts in your name.
- Requests for your login or a code.
Common warning signs
- BNPL messages with login links.
- Orders or installment plans you did not create.
- Requests for your one-time code.
- Emails from lookalike BNPL domains.
Example wording scammers use
“Your Klarna payment failed — update your details to avoid a late fee: klarna-account-verify.net”
“A new Afterpay order was placed. If this wasn't you, sign in to cancel.”
These are illustrative examples written by ScamSplain, not real messages.
What the scammers want
- Access to your BNPL account or identity.
- To buy goods on installment in your name.
- Your login and verification codes.
What to do
- Log into BNPL apps directly, not via links, to check activity.
- Use strong, unique passwords and app-based 2FA.
- Never share one-time codes.
- Monitor your email/bank for BNPL sign-ups.
What to do if you already responded
- Change the BNPL and linked-email passwords; contact the provider to dispute.
- Check your credit for accounts opened in your name; consider a freeze.
- Report at IdentityTheft.gov and reportfraud.ftc.gov.