{"id":7192,"date":"2022-09-28T08:27:55","date_gmt":"2022-09-28T08:27:55","guid":{"rendered":"https:\/\/newmoneyreview.com\/?p=7192"},"modified":"2022-11-07T16:08:07","modified_gmt":"2022-11-07T16:08:07","slug":"buy-now-pay-less-ornot-at-all","status":"publish","type":"post","link":"https:\/\/newmoneyreview.com\/index.php\/2022\/09\/28\/buy-now-pay-less-ornot-at-all\/","title":{"rendered":"Buy now pay less or\u2026not at all"},"content":{"rendered":"

How criminals can profit from shared liability<\/em><\/p>\n

BNPL (Buy Now Pay Later) is a type of short-term financing allowing consumers to make purchases and pay at a later date (often interest-free).<\/p>\n

It\u2019s been one of the great financial technology (\u2018fintech\u2019) success stories of the last decade. BNPL loans have soared in the last couple of years<\/a> as consumers took advantage of a promise to get goods for a limited upfront payment.<\/p>\n

24 percent of Europeans now use BNPL at online checkout. But BNPL is now preoccupying regulators as rising interest rates and concerns over bad debts have caused the value of key BNPL players like Sweden\u2019s Klarna to crash<\/a>.<\/p>\n

BNPL has added convenience for consumers, though it\u2019s also been put to questionable uses. In a recent case, a US-based BNPL provider called Credova offered no-interest loans to buy guns and ammunition<\/a> under the marketing slogan \u2018shoot now, pay later\u2019.<\/p>\n

Fraudsters are never slow to jump on a new tech trend<\/p><\/blockquote>\n

And there\u2019s another thing to worry about when it comes to BNPL. Below I will show how simple it is to use stolen identities to take money from any merchant that supports BNPL companies as a payment mechanism.<\/p>\n

Fraudsters are never slow to jump on a new tech trend, and at this point, several well-documented fraud schemes against BNPL either use stolen card details or delay payments to the merchant<\/a>.<\/p>\n

After my previous work in synthetic identities and card fraud<\/a>, I looked at how criminals could utilise security gaps to steal money from BNPL providers. And I was shocked by how little effort is required to amplify synthetic identity fraud and bring lucrative criminal schemes to the next level.<\/p>\n

Step 1. Issuing a card using a fake identity<\/strong><\/p>\n

For the BNPL provider I chose, the registration process starts with adding an existing debit or credit card.<\/p>\n

Using a stolen card for this step is infeasible for many BNPL providers, including the one I picked. That\u2019s because most European payment services now require proper 3D-Secure verification<\/a> (they send a one-time code to a separate device of yours before authorising a payment).<\/p>\n

But adding his or her own card to the BNPL app as a source of funds would leave an unnecessary trail that could eventually lead to the criminal. What if there were a way to create a Visa or MasterCard card with no link to the real identity? Would criminals be happy to use that advantage against BNPL providers?<\/p>\n

So instead of using one of my own cards, I issued a new Samsung Pay+ (virtual) card, without any formal verification, using my friend\u2019s name.<\/p>\n

I showed how easy it is to spend up to \u00a3100 on a card set up with a fake ID<\/p><\/blockquote>\n

Even if you don\u2019t have a willing friend, it\u2019s relatively easy to perform this step. In a previous New Money Review<\/em> article<\/a>, I showed how easy it is to spend up to \u00a3100 on a card set up with a fake ID.<\/p>\n

This is because certain fintech apps (like Samsung Pay+) use a customer identification process called \u2018progressive know-your-customer (KYC)\u2019 when onboarding new clients. They don\u2019t ask for the standard proof of identity (passport, utility bill, liveness check) until you spend more than that first \u00a3100.<\/p>\n

I still need another\u2013legitimate\u2013card to fund the scheme. This time I will use my own card to add funds to the Samsung Pay+ card. Does a criminal still need to provide a real identity? We will come back to that later.<\/p>\n

Setting up a fake BNPL account <\/em><\/p>\n

\"\"<\/p>\n

Step 2. BNPL registration using a newly issued card<\/strong><\/p>\n

If Facebook were to offer you a BNPL scheme, it would likely know everything about you: your salary, your outgoings, even when you are likely to die (and default on the payment). But the BNPL provider I picked didn’t have such information about me.<\/p>\n

Instead, the provider just asks for a valid card to ensure that the customer is genuine. To keep its customer retention levels high, it won’t carry out proper KYC checks either, meaning no proof of address or proof of identity is required.<\/p>\n

So, if I were a criminal, I\u2019d buy a fresh SIM card and use the same approach as in my previous New Money Review<\/em> article, picking information about some existing individuals from one of the public UK databases.<\/p>\n

It\u2019s the easiest way to get a correct name-address match. If a criminal could discover the date of birth of a potential victim, even better. That would bring him to the desired card enrolled under a fake name.<\/p>\n

At this point, you may ask: surely you can\u2019t just look up someone\u2019s name and address in a public database and then use it to create a fake ID. Well, money laundering expert Graham Barrow has been pointing out for years just how easy it is to do this using the Companies House database<\/a>.<\/p>\n

In a recent case, fraudsters stole the identities of a civil servant at the UK Ministry of Justice and an employee of the UK\u2019s tax authority to set up shell companies<\/a> (for likely use in money laundering). You can\u2019t say that criminals don\u2019t have a sense of humour.<\/p>\n

So now we will add the card that we just issued (with a fake ID) as a source of funds in a BNPL app. Again, this card has nothing to do with me – if a debt collector decides to find me having information that I left in the system, they will struggle to do that. In other words, we could use anyone\u2019s personal details to issue a virtual card and create a BNPL account.<\/p>\n

You don\u2019t need too much information to create a BNPL account<\/em><\/p>\n

\"\"\"\"<\/p>\n

Step 3. Buying products<\/strong><\/p>\n

Once I set up a BNPL account, I looked at the list of stores that work with that provider to find a victim. I ended up picking the popular high street store H&M.<\/p>\n

Criminals try to maximise their benefits and turnover rates. Buying gift cards would probably be the way of making the most money from BNPL fraud. H&M, though, does not allow purchases of gift cards using the BNPL scheme (which is smart of them!)<\/p>\n

So the next best option from the criminal\u2019s perspective is to buy expensive but popular gadgets (iPhones, iPads, Nintendo, etc.). But my \u2018purchase\u2019 was more modest: I simply decided to upgrade my socks and collected almost a \u00a350 basket.<\/p>\n

My BNPL basket at H&M<\/em><\/p>\n

\"\"<\/p>\n

When you shop online, you have a billing address and a delivery address. A lot of checks are made around the billing address. If a customer sets one billing address in the BNPL app and a different billing address in the checkout form, the BNPL provider may notice that and the purchase will be suspended. But the delivery address could be anything.<\/p>\n

Obviously, criminals would not order products using their real address, but using public addresses with easy access instead, such as a hotel reception or an apartment block with a concierge.<\/p>\n

A lot of stores using BNPL services provide the perfect option for fraudsters: you can choose \u201ccollect from the store\u201d<\/p><\/blockquote>\n

In the Lichtenstein\/Morgan case currently being prosecuted in the US<\/a> (the two are accused by the Department of Justice of having stolen more than $5bn in bitcoin from the crypto exchange Bitfinex), the alleged fraudsters apparently did just that: they ordered goods (probably fake passports and IDs) online, then picked up the packages anonymously from hotel receptions and post offices<\/a>.<\/p>\n

But we don\u2019t need to go to those lengths. A lot of stores using BNPL services provide the perfect option for fraudsters: you can choose \u201ccollect from the store\u201d.<\/p>\n

The bottom line is that as long as the billing address in the basket is the same as the address in the BNPL system, you won\u2019t get banned or checked. At the \u201ccheckout with the BNPL provider\u201d step, depending on the current risk calculation, criminals then have a few options: pay 25% or 30% now and the rest within the next few weeks, or pay everything in 30 days’ time. Both of these options are quite lucrative if you do not plan to pay in the end.<\/p>\n

BNPL providers offer to split payments into three across 60 days or postpone the full payment for 30 days<\/em><\/p>\n

\"\"\"\"<\/p>\n

Step 4. Getting away with fraud<\/strong><\/p>\n

Fraud has been committed. What\u2019s next? In 30 days, when a customer refuses to make his next payment, he will fall into a default category. Whose fault is that? Under current UK regulations, merchants are liable for any BNPL defaults. Most BNPL providers do not take responsibility for fraud risks; for the few that do, it\u2019s a gesture of goodwill.<\/p>\n

When a criminal refuses to pay, the victim of identity theft will receive a rather confusing\u2013and alarming\u2013letter<\/em><\/p>\n

\"\"<\/p>\n

Now, let\u2019s imagine that a merchant decided to sell the unpaid debt to a debt collecting agency that\u2019s very eager to find the criminal. And it\u2019s possible, in theory, that they could do so if the criminal had used his own card, as I did this time.<\/p>\n

if I were a debt collector, I\u2019d put this case away and focus on something easier<\/p><\/blockquote>\n

But let me remind you of the long chain of instances involved in the crime:<\/p>\n