BNPL Providers Could Do a Better Job Protecting Consumers, Consumer Reports Finds

Despite the increasing popularity of buy now, pay later loans, some BNPL providers could do a better job when it comes to providing consumer protections, such as disclosing fees and enabling consumers to manage their data and privacy settings, a study by Consumer Reports found.

When it comes to the disclosure of fees and changes in the terms of service, Consumer Reports determined that six of the eight BNPL providers examined for the study provide no notice to users of changes to the terms and conditions of the service. The two BNPL providers that do are Afterpay Ltd. and Zilch Technologies Ltd., which expanded its service to the United States in 2022.

Consumer Reports evaluated eight BNPL providers: Affirm Holdings Inc., Afterpay, Klarna AB, PayPal Holdings Inc., Perpay Inc., Sezzle, Zilch, and Zip.

Other areas where BNPL providers could improve their disclosures lie in late fees and interest. Six of the eight BNPL providers charge late fees ranging from a few dollars up to 25% of the loan amount. The exceptions are Affirm and PayPal. “Because there are so many different kinds of BNPL loans, including some that charge interest, consumers may be confused about the type of product they are being offered and at what cost,” the report says.

Fraud monitoring, and notifications when fraud is suspected, is another area where BNPL providers fall down, according to the CR results. Indeed, several BNPL providers tend to make vague commitments to safeguard users’ personal information, restrict employee access to sensitive data, or fail to respond to security vulnerabilities, says Delicia Hand, director of financial fairness for CR.

In addition, none of the BNPL providers explicitly promises to notify users of cybersecurity breaches that could put their information at risk.

“If consumers are not put on notice about how the BNPL provider will contact them about fraud, consumers may miss an opportunity to prevent or catch fraud, and that can lead to financial debt,” says Hand, who joined CR in 2022 from the Consumer Financial Protection Bureau.  “[Not all] BNPL providers are sufficiently notifying consumers about fraud risk.”

Among the providers evaluated, PayPal provided the most comprehensive fraud protection, while Afterpay and Klarna stood out for their commitments to guard against fraud and to alert users of suspicious transactions.

Collection of unnecessary consumer data, such as Internet browsing history, email and chat communications, video and voice recordings, geolocation information, and biometric data, is also an area where BNPL providers can improve. While the consumer data collected is typically not sold, most BNPL providers share it with third parties for advertising and marketing purposes.

“Consumers should be allowed to consent to have their data used for marketing purposes, as opposed to being defaulted into consent,” Hand says. “Consumers that don’t consent to have their data shared can wind up getting loads of unwanted marketing and advertising offers. There needs to be meaningful transparency when it comes to the sharing of data.”   

Lastly, BNPL providers can do a better job protecting consumer privacy by offering more transparent privacy controls. PayPal ranks the highest in this measurement, offering comprehensive controls, such as the ability to to change data tracking and sharing permissions, while Affirm and Klarna provide users with limited privacy settings, such as the ability to track all orders and opt out from being remembered by merchants. Most apps don’t enable users to easily access and delete their data, CR says.

“Consumers should be allowed to manage their own data assets and data controls and be educated [by BNPL providers] about ways to protect and permission their data,” says Hand. “For consumers, it’s important to pay close attention to the terms and conditions of their BNPL loan, because not all BNPL loans are the same.”