BNPL Fraud in Australia: Why new rules make data quality critical

Buy now, pay later (BNPL) has become a mainstream payment method in Australia.

According to Finder's Consumer Sentiment Tracker, 41% of Australians had used a BNPL service in the previous six months as of March 2026, with adoption remaining above 40% for five consecutive years. What was once considered an alternative payment option is now firmly embedded in Australia's digital commerce ecosystem, particularly among Gen Y and Gen Z consumers.

However, rapid adoption has also attracted increasingly sophisticated BNPL fraud. Combined with rising consumer debt and greater regulatory scrutiny, it has prompted the most significant overhaul of BNPL regulation since the industry emerged.

Australia's BNPL Regulatory Landscape Has Changed

From 10 June 2025, BNPL providers stopped operating in a regulatory grey area. Under the Treasury Laws Amendment (Responsible Buy Now Pay Later and Other Measures) Act 2024, BNPL contracts are now regulated under the National Consumer Credit Protection Act as a new category known as Low Cost Credit Contracts (LCCCs).

Providers must now:

• Hold an Australian Credit Licence with the appropriate authorisations.
• Comply with responsible lending obligations.
• Become members of the Australian Financial Complaints Authority (AFCA), providing consumers with access to independent dispute resolution.

For many providers, this represents far more than a compliance exercise. Responsible lending expectations place greater emphasis on verifying customer income, expenses and existing debts before extending credit. Fee structures are also subject to legislative limits, and products that exceed the prescribed fee thresholds may fall outside the Low Cost Credit Contract framework.

While the legislation focuses on responsible lending, its success ultimately depends on one critical factor: trusted customer data. Providers cannot accurately assess affordability, verify identities or detect fraudulent applications if the underlying customer information is incomplete, inaccurate or fabricated.

For finance leaders, the message is clear. Regulators now expect BNPL providers to apply the same level of diligence around customer verification and creditworthiness that has long existed across traditional lending.

BNPL Fraud Is Growing Alongside Adoption

Australia's broader fraud landscape highlights why stronger oversight of BNPL has become increasingly important. According to the Australian Bureau of Statistics, 10.4% of Australians - approximately 2.3 million people - experienced card fraud during the 2024–25 financial year, making it the most common type of personal fraud.

BNPL platforms present an attractive target because they combine rapid approvals, deferred payments and historically lighter verification processes.

Common BNPL fraud schemes include:

• Account takeover, using stolen customer credentials to make purchases through legitimate accounts.
• Synthetic identity fraud, where genuine identity information is combined with fabricated personal details to create convincing but false customer profiles.
• Refund abuse and first-party fraud, exploiting merchant goodwill and payment disputes.
• Trust-building fraud, where criminals establish a positive repayment history through smaller purchases before making a much larger fraudulent transaction.

Although these attacks vary in sophistication, they all rely on one common weakness: customer information that cannot be properly verified.

Cost-of-Living Pressures Are Increasing the Risk

Consumer financial pressure is adding another layer of risk.

Finder research suggests around one-third of Australian BNPL users say they could not effectively manage their finances without these services. At the same time, the average outstanding BNPL balance reached approximately A$1,110 as of March 2026, reflecting ongoing cost-of-living pressures.

As financial stress increases, so does the incentive for both organised fraud rings and opportunistic first-party fraud. Providers that continue relying on weak identity verification or manual review processes become increasingly vulnerable.

Why BNPL Fraud Is a Data Quality Problem Before It Is a Compliance Problem

New licensing requirements alone will not prevent BNPL fraud.

An Australian Credit Licence and AFCA membership cannot identify a synthetic identity, detect a fabricated address or determine whether multiple applications originate from the same fraudulent actor. Those capabilities depend on the quality of the data collected throughout the customer lifecycle.

Identity verification begins with accurate customer information. Address verification plays an important role because invalid, incomplete or unverifiable addresses can be an early indicator of elevated fraud risk. A mismatch between billing and delivery addresses, or an address that cannot be confirmed as a legitimate location, should trigger additional verification.

When combined with identity, email and phone verification, address verification creates a stronger foundation for BNPL fraud prevention. Together, these capabilities help organisations detect synthetic identities earlier, reduce account takeover risk and strengthen responsible lending decisions before credit is approved.

The cost of identifying suspicious applications during onboarding is significantly lower than managing chargebacks, hardship claims, regulatory investigations or customer disputes after fraudulent transactions have occurred.

What Finance and Risk Leaders Should Do Next

As Australia's BNPL market enters a more heavily regulated environment, finance and risk teams should focus on three priorities.

1. Strengthen Customer Verification

Ensure BNPL programmes incorporate comprehensive identity, address, email and phone verification during account creation, not simply during credit assessment.

2. Automate BNPL Fraud Detection

Treat identity and address mismatches as high-priority fraud indicators. Automated verification enables suspicious applications to be identified before they become financial losses.

3. Build Compliance on Trusted Data

Responsible lending obligations are only as effective as the customer data supporting them. High-quality, verified data strengthens compliance, improves risk decisions and helps preserve a provider's regulatory standing.

Trusted Customer Data Is Becoming a Competitive Advantage

Australia's BNPL industry has entered a more regulated era. Compliance is no longer measured solely by licensing requirements - it is measured by how confidently providers can verify customers, detect BNPL fraud and make responsible lending decisions.

As fraud becomes increasingly sophisticated and regulatory expectations continue to evolve, trusted customer data has become an essential component of effective BNPL fraud prevention, responsible lending and long-term customer trust.

Organisations that invest in accurate identity and contact data today will be better positioned to reduce fraud losses, meet evolving compliance obligations and strengthen customer trust in Australia's rapidly evolving BNPL market.

To learn more about how Melissa helps Australian organisations verify identity, address, email and phone data at scale to reduce BNPL fraud and strengthen responsible lending, visit melissa.com/en-au.