You get a text about a payment due. Or a collector calls about a store you never shopped at. Either way, someone may have opened a buy now, pay later (BNPL) account using your name. It happens because approvals are fast and checks can be light. This guide covers what to look for, what to do first, and where the rules are still murky.

A phone and an open notepad on a sunlit kitchen table, with a person's hands resting nearby as they review an unfamiliar payment notice.
A person at a kitchen table reviewing a phone notification about an installment payment they do not recognize, with a notepad beside them.

How a fake BNPL account gets made

There are a few common routes. None of them need much from you.

The first is plain new-account fraud. A scammer uses stolen personal information to apply. Quick approvals can let purchases go through before the real person knows the account exists, according to a consumer-safety write-up on BNPL scams (Take Care).

The second is account takeover. If you already have a BNPL account, a scammer may get your login through a phishing email or text. Then they change the details or the payment method. Some fraudsters even build trust with a normal-looking account first, then swap in a stolen card. The same source calls this a Trojan horse approach.

The third is synthetic identity fraud. That mixes real data, like a stolen Social Security number, with made-up details. The application looks legitimate enough to pass.

Red flags worth a second look

Small installments are easy to miss. The CFPB reported that the average BNPL purchase in 2023 was $135, or under $34 per payment when split in four, as cited in that same Take Care article. That is the size of a streaming bundle or a lunch habit. It blends in.

  • Installment payments for merchants you do not remember.
  • Late fees or other fees on an account you never used.
  • Notices from a BNPL provider you have never signed up with.
  • Login or password-reset alerts you did not request.
  • A collector calling about a balance you do not recognize.

Check your bank statements and email for payment notices on a regular schedule. Do not wait for a bill to tell you something is wrong.

What to do first

Order matters here. Start with the steps that stop more damage.

  1. Contact the provider. Use the phone number or website on your own statements or the official app. Do not use a link or number from a text or email. Ask whether the account was opened or changed by you. Write down who you spoke with and when.
  2. Contact your financial institutions. The CFPB advises reaching the security or fraud departments right away and closing compromised accounts (CFPB).
  3. Consider a fraud alert or security freeze. The CFPB lists both as options. A freeze restricts access to your credit report for new credit. Each credit bureau explains how to request one on its own consumer pages. The sources here do not give step-by-step instructions, so use the bureaus directly.
  4. Report the theft. Go to IdentityTheft.gov, run by the FTC. You get an Identity Theft Report and a recovery plan.
  5. File a police report. The CFPB recommends it. It can help when you dispute accounts with creditors.

Beware the rescue scam

Once your information is out, a second scam often shows up. Someone calls claiming to be from the FTC, the CFPB, the police, or your bank. They say your money is in danger.

The FTC does not threaten people. It does not ask you to transfer money to protect it. It does not ask you to withdraw cash or buy gold. If any caller does, that is the scam. Hang up and look up the official number yourself.

Records, credit reports and collectors

Keep everything. Save the fraudulent statements, emails, your Identity Theft Report and notes from every call. If a provider or collector pushes back later, paper helps.

Next, check your credit reports for accounts you do not recognize. The official annual credit report site offers free reports. A fake BNPL account may show up there, though the sources do not explain exactly how these accounts are reported or how to get one removed. Ask each bureau and the provider what their process is.

If a collector calls, do not assume you owe the balance. Tell them in writing that the account may be fraudulent, and mention your Identity Theft Report. The sources do not say whether you must pay a fraudulent balance. That is a question for the provider and, if it escalates, a qualified professional. Then ask the provider to confirm in writing that the account is closed or the charges are removed. Check later statements to make sure it stuck.

The sources also do not say how long recovery takes or which documents a given provider will want. Ask them directly.

Where the legal protections stand

This part is unsettled. Credit cards come with Truth in Lending Act protections, including statements that show charges, fees, payments, due dates and where to send billing disputes. In 2024 the CFPB issued an interpretation that would have given BNPL users similar treatment. In April 2025 the agency withdrew it, though courts may still consider that reasoning, according to the National Consumer Law Center (NCLC).

Some providers may still follow those practices voluntarily. That is not guaranteed. The same source notes BNPL accounts can be hacked and can contain errors in charges, fees or payment credits.

The sources do not spell out your federal rights after the withdrawal. If a dispute drags on, look at your state consumer protection resources and consider individualized guidance. This article is educational only. It is not legal, financial or tax advice.