BNPL Fraud in Saudi Arabia: Patterns and Rules

Buy now, pay later is one of the fastest ways to pay online in the Kingdom. It is also one of the easiest products to abuse, because the customer walks away with the goods after paying only the first instalment. When the second one never arrives, the loss is the whole basket, not a fee.

BNPL fraud is rarely one dramatic event. It is a pattern spread across signup, the first order, and the weeks that follow. Teams that only score the payment at checkout see a normal first instalment and approve it. The signals were there earlier.

The four patterns behind most BNPL losses

Stolen or borrowed identity. Someone opens an account with another person's details, passes the identity check because the details are real, and orders goods they never intend to pay for. The real person finds out when collections calls.

Account takeover. An attacker gets into a genuine customer's account, often through a stolen password or a code the customer was tricked into sharing, and uses that customer's approved limit on high-value orders shipped to a new address.

Stolen cards on the first instalment. The first payment goes through on a card that is not the customer's. The order ships. The card owner disputes the charge, and the later instalments fail because the card is blocked.

First-party default. The customer is who they say they are and never planned to pay. This looks like credit risk, but it often comes with fraud signals: several accounts on one device, a burst of orders right after approval, goods that resell easily.

Signals worth sending at signup

Most of these patterns leave a trace before the first order.

• The device fingerprint is already linked to other accounts, especially accounts that defaulted.
• The phone number or email was used on another account recently.
• Signup, identity check, and first order all happen within a few minutes.
• The delivery address does not fit the rest of the profile, or is shared with unrelated customers.
• The network is a hosting range or a VPN with no history for this customer.

None of these should block a signup on its own. Together, they decide how much limit a new customer gets and whether the first order needs a second look.

Signals at checkout

Score every order as an event, not only the payment.

• A new device on an established account, followed by a change of phone number or delivery address in the same session.
• Several orders in a short window that together approach the customer's full limit.
• Goods that are easy to resell, ordered by an account that has never bought that category before.
• A first-instalment card that does not match the name on the account, or a card already used by other customers.

Write the rules as sentences your team can defend. "New device, address changed, and an order above 80% of the available limit within one hour of login" is a rule. "High BNPL risk" is not.

Rules to start with

1. Three or more accounts on one device fingerprint: send new orders to REVIEW and hold limit increases.
2. Login from a new device, then a contact or address change, then an order in the same session: REVIEW or a step-up through a channel the attacker does not control.
3. A first-instalment card already used by another customer: REVIEW.
4. A delivery address shared by customers with no apparent link: REVIEW, and BLOCK once the cluster is confirmed.
5. Orders that use most of the limit within an hour of approval: hold fulfilment until the order is checked.

Start every rule in observation mode. Run it against a few weeks of real orders and compare what it would have flagged with the accounts that later defaulted or disputed. That comparison, not a vendor's average, tells you where to set each limit.

Do not punish good customers

Families share phones. People move house. A customer buying a phone for a relative will use a different delivery address. If every one of these gets declined, your approval rate drops and customers go to the next BNPL app at checkout. Use REVIEW and a quick step-up for the ambiguous cases, and keep BLOCK for devices, cards, and addresses you have already confirmed.

Connect fraud and collections

The best training data for BNPL fraud rules sits with your collections team. Every account that never paid a single instalment after the first is a candidate fraud case. Tag those accounts, send the outcome back to your fraud system, and look at what they had in common at signup. You will find the next rule there.

Naiza scores signups, logins, account changes, and orders as separate events with device and network context, so rules can see the whole sequence rather than one payment. The fraud detection API explains the event model, and the device intelligence page covers how shared devices are linked across accounts.