Red Flags of Buy Now Pay Later Fraud and How to Stay Safe

BNPL fraud is any scam or misuse that runs through a buy now pay later account, app or offer. It includes fake apps that harvest your KYC documents, loans opened in your name, fees that were never disclosed, and recovery calls that cross the line. The fastest protection is to act only inside apps and links you reached yourself, never share an OTP, and report quickly if money or identity details have already gone.

This guide covers what fraud on pay later products looks like, how to tell a genuine lender from a fake one, how hidden charges add up, and where to complain. If you want the basics of how pay later products work, the BillCut guide on buy now pay later in India explains them, so this page stays on the fraud side.

What does BNPL fraud look like in India?

BNPL fraud usually takes one of five shapes. Each one exploits the same thing: a pay later product approves quickly, asks for little, and works through a phone number and an OTP. That speed is useful for you, and it is useful for a scammer too.

• Fake apps and cloned websites. A page copies the look of a known pay later brand and asks you to enter your PAN, Aadhaar details, selfie and bank details to “activate a limit”. The limit never arrives, and your documents are now with someone else.
• Identity theft. Someone uses your documents, or a SIM they obtained in your name, to open a pay later account or loan you never asked for. You discover it when a reminder or a credit report shows a balance you do not recognise.
• Account takeover. A scammer gets your OTP or resets your login and spends your existing limit on goods delivered elsewhere.
• Fake merchant and offer scams. A seller on social media offers a deep discount if you pay through a pay later link, then disappears after the first instalment or ships nothing.
• Predatory lending and harassment. A small loan app disburses a small amount, deducts heavy fees upfront, and then uses your phone contacts and threats to collect.

What are the red flags of a fake BNPL app or offer?

A fake pay later app usually gives itself away before you enter any money, through the permissions it asks for, the promises it makes and the pressure it applies. Check these signs before you register, not after.

• It asks you to pay first. A “processing fee”, “insurance” or “verification deposit” demanded before any credit limit is shown is a strong warning. A genuine lender discloses its charges inside the loan terms, not as a separate payment to a personal UPI ID.
• “No verification” or “100 percent approval”. Real lenders run KYC and a credit check. An offer that skips both is not offering you credit, it is collecting your data.
• It requests access to contacts, photos or your SMS inbox. Access to your contact list or gallery is not needed to approve a limit. Apps that ask for it often use it later to shame borrowers.
• The money arrives from or goes to a stranger. Disbursal into a third party account or collection to a personal UPI handle is a clear mismatch with how a regulated lender works.
• Urgency and rewards. “Limit expires in 10 minutes” is a pressure tactic designed to stop you from reading the terms.
• The link reached you from a message. A link in an SMS, WhatsApp forward or social post is not a safe route to an app. Install only from the official store listing you searched for yourself.
• An OTP request on a call. A genuine provider does not need your OTP, PIN or CVV to “release” a limit.

General phishing mechanics are covered in the BillCut explainer on payment fraud and phishing links.

How can you tell a genuine lender from a fake one?

You can tell by how money moves, how fees are shown and what the app does with your data. The comparison below sets a regulated lender app against a typical fake or predatory app, with total cost shown as an outcome, not only a rate.

Check	Regulated lender app	Fake or predatory app
Who the lender is	A named bank or NBFC, with the app acting as a service provider	No clear lender name, or a company name you cannot match to a registered entity
Fee disclosure	A key fact statement showing total cost before you accept	Charges appear after approval or are deducted from the amount you receive
Money movement	Disbursed to your bank account and repaid to the lender’s account	Paid to or collected through personal wallets and unknown UPI IDs
Permissions	Limited to what the service needs	Contacts, gallery and SMS access demanded
Exit options	A cooling off window and a grievance process	No working support, or support only through messaging apps
Collections	Defined process by the lender or a properly instructed agent	Repeated calls, abuse and messages to your contacts
Outcome for you	Cost is known upfront and can be compared	Cost is unclear and can far exceed what you borrowed, or you lose your data and money

These differences rest on the rules the Reserve Bank of India sets for digital lending. The RBI Digital Lending Directions, 2025 set out a key fact statement, direct disbursement between lender and borrower accounts, limits on the data an app may access, a cooling off period and a grievance redressal route. If an app does not operate that way, treat it as a warning.

How do you check whether a lender or app is registered?

The Reserve Bank of India runs the Sachet portal, where you can check whether an entity is registered and report illegal lending or money collection. Use it before you share documents with an unfamiliar app. If you cannot find the lender behind an app, stop there.

How does identity theft lead to BNPL fraud?

Identity theft leads to BNPL fraud when someone gets enough of your personal details to pass a pay later app’s KYC and onboarding. Usually that means your name, mobile number, PAN, Aadhaar details and a selfie, and sometimes control of your SIM to receive OTPs.

The warning signs are small: a welcome message for an app you never installed, a reminder for a balance you did not create, or an unfamiliar account on your credit report. Any one deserves action the same day.

A sudden loss of mobile signal can also be a sign, because a duplicate SIM can give a scammer your OTPs. The BillCut guide on loan fraud after a lost SIM card walks through what to do in that situation.

Your credit report is the clearest place to spot a loan you did not take. TransUnion CIBIL lets you access your report, and other bureaus do the same. Unknown accounts, unfamiliar enquiries or a sudden score drop should be reported to the lender first and then escalated. A fraudulent account left alone can also drag down your score, which is why the effect of pay later accounts on credit is covered in BillCut’s piece on credit score implications of BNPL.

What hidden fees show up in BNPL products?

Hidden fees are charges that are real but placed where you are unlikely to read them, or that are described in a way that hides their total. Not every fee is fraud. The problem starts when a charge is not shown before you accept, or when it keeps being added.

Charge	How it can appear	What to ask
Processing fee	Deducted from the amount you receive or added to the first instalment	Is it in the key fact statement, and is it charged again on renewal?
Convenience or platform fee	Added per instalment or per transaction	Is it per instalment or one time?
Late payment fee	Charged when an instalment is missed	Is it a flat amount, and is it stated in the agreement?
Penalty on penalty	A penalty that is added to the balance and then earns interest	Is the penalty a flat charge, not compounded?
Auto renewal or subscription	A paid plan switched on during sign up	Did you tick a box, and can you cancel?

On penalties, the Reserve Bank of India has directed that a penalty in a loan account must be a flat penal charge and cannot be compounded into the interest rate, as set out in its circular on penal charges in loan accounts. If a regulated lender is compounding penalties, that is worth raising in a complaint.

What does a hidden fee cost in a real purchase?

Here is an illustrative example. The numbers are assumptions, not a quote from any provider. Suppose you buy a phone accessory for Rs 12,000 and split it into three equal instalments of Rs 4,000.

Item	Assumption	Amount
Purchase price	Split into 3 instalments of Rs 4,000	Rs 12,000
Processing fee	3 percent of Rs 12,000, charged once	Rs 360
Convenience fee	Rs 99 on each of 3 instalments	Rs 297
Late fee	One missed instalment, flat Rs 250	Rs 250
Total fees	Rs 360 plus Rs 297 plus Rs 250	Rs 907
Total paid	Rs 12,000 plus Rs 907	Rs 12,907

You pay Rs 907 more than the sticker price over three months, which is about 7.6 percent of the purchase (907 divided by 12,000). None of those charges is interest, so a seller advertising “zero interest” can be accurate and still expensive. The question to ask before accepting is the total you will pay, not the interest rate.

If the fees were not visible until after you agreed, or the amount you paid is higher than the statement showed, keep screenshots and raise it with the lender in writing.

Once you see how quickly fees and fake offers add up, the next risk is a debt that is already growing. If high interest card balances are part of your picture, you can see how BillCut helps restructure credit card debt into manageable EMIs and decide whether it fits you.

What counts as collection harassment, and what can you do about it?

Collection harassment is repeated threats, abuse, contact with people who are not your guarantors, or public shaming to force payment. A lender is entitled to ask you to repay a genuine debt. It is not entitled to intimidate you.

The Reserve Bank of India’s guidelines on recovery agents cover recovery agent conduct, including limits on contact hours and a prohibition on intimidation. Those rules apply to regulated lenders and their agents. An unregistered app is outside that framework, which is part of why checking registration first matters.

If you are being harassed:

1. Do not pay a new demand under pressure. First confirm whether the debt exists and who the lender is.
2. Save call logs, screenshots, message threads and any recording you lawfully hold.
3. Write to the lender asking for a statement of the amount and its breakup.
4. If the lender is regulated, use its grievance process and then escalate through the routes below.
5. If you receive threats, morphed images or messages sent to your contacts, report it as a cyber offence and consider a police complaint.

How do you prevent BNPL fraud before it happens?

You prevent most BNPL fraud by controlling three things: where you install and log in, what you share, and how closely you watch your accounts. These steps cost nothing and take minutes.

• Install only from the official store listing you searched for. Do not install from a link in a message, an ad or a forwarded file.
• Never share an OTP, PIN or CVV. Not with a caller, a delivery agent, or “support” on a messaging app.
• Read the key fact statement. Look for the total cost, the lender’s name and the cooling off terms before you accept.
• Do not pay an upfront fee to get credit. Charges that must be paid to a personal account before approval are a red flag.
• Review your credit report periodically. Unknown accounts show up there first.
• Use refund and dispute channels in writing. BillCut’s guide to BNPL refund rules shows how to raise a refund issue.

Where do you report BNPL fraud in India?

You report BNPL fraud to the lender or provider first, then to the cyber authorities if money or identity has been misused, and then to the regulator if the lender is regulated and did not resolve it. Which route you use depends on what happened.

Situation	Where to report	What to carry
Money lost or account misused online	National Cyber Crime Reporting Portal, helpline 1930	Transaction IDs, screenshots, phone numbers
Illegal or unregistered lending app, or illegal money collection	RBI Sachet portal	App name, link, payment details, messages
Complaint against a bank or NBFC that was not resolved	RBI Complaint Management System	Your earlier complaint and the reply or lack of one
Poor service by a provider or seller	National Consumer Helpline, toll free 1915	Order details, invoice, correspondence

Tell your bank and the pay later provider at the same time as you file the online report.

How does BillCut fit into this problem?

BillCut is a debt refinancing platform, and it is a provider in that category, so weigh this section with that in mind. BillCut helps Indian borrowers convert high interest credit card debt into structured, lower interest EMIs. It is not a fraud reporting service, and it does not recover money lost to scams.

Where it can be relevant is the aftermath. Some people who were caught by a fake offer or a fee trap end up carrying card balances they cannot clear at the card’s interest rate. Others are stretched by several small pay later dues at the same time. If that is your situation and the balance is on a credit card, restructuring it into one planned EMI may reduce the pressure, subject to eligibility and the terms offered to you.

It will not help with an app that is harassing you, a loan opened in your name, or money already taken by a scammer. For those, use the reporting routes above first. Compare any restructuring offer, including BillCut’s, on total cost and total time, not only the monthly EMI.

Who should and should not use these steps and options?

Match your situation below to see which part of this guide fits.

Your situation	What fits
You have not yet used a pay later app and received an offer	Verify the lender through Sachet and read the key fact statement before registering
You see a transaction or account you did not create	Contact the provider and bank, report to the cyber portal, check your credit report
You are facing threats or contact to your phonebook	Document everything and use the complaint routes, including the police for threats
You owe genuine card debt at high interest	A restructuring option such as BillCut may be worth comparing, if you qualify
You lost money to a fake app	Report first. A debt restructuring service does not recover scam losses

Debt restructuring is less suitable if your problem is fraud rather than debt, if the balance is not on a credit card, or if you cannot afford the EMI even at a lower rate. It does not cancel a debt, and it may involve fees and a longer repayment period.

What should you do in the next 24 hours if something looks wrong?

Treat the next day as a checklist, not a crisis. Damage from pay later fraud tends to grow when people wait, delete messages out of embarrassment, or pay a stranger to make the problem stop.

1. Stop engaging with the caller or app, and make no new payment.
2. Screenshot everything before you uninstall anything.
3. Call your bank and the provider on the numbers printed on your card, statement or official app, and ask to block the account or card.
4. Report on the National Cyber Crime Reporting Portal or call 1930 with the transaction details.
5. Change passwords, log out of unknown devices, and contact your mobile operator if your SIM stopped working for no reason.
6. Check your credit report for accounts you did not open and dispute them in writing with the lender concerned.

No guide can promise that lost money comes back. Recovery depends on how quickly it was reported and what the bank and authorities find. What you control is speed and documentation, and being caught by a convincing offer does not mean you were careless.

Frequently Asked Questions