A Buy-Now-Pay-Later Plan You Never Opened: What to Do
An email, app notice or collector shows a pay-later plan in your name for a purchase you never made. Who to contact, what not to pay and how to clear it up.
“Your first installment is due.” You have never used that app, you did not buy those sneakers, and now it wants a payment or sends you to collections. Someone has probably used your details, and it can be cleared up. Start with the checklist, then work through the details.
1. Do not pay, even a small amount, until you have told the lender it isn’t yours. 2. Do not use links in the message. Go to the lender’s own website or app. 3. Report it as identity theft to the lender. 4. Create a report at IdentityTheft.gov. 5. Freeze your credit. 6. Check any bank account or card tied to the plan.
First: is the message itself real?
Holiday shopping fills inboxes with payment reminders, and a fake “your installment failed” email might be trying to get you to log in somewhere. So don’t click. Open the lender’s app directly, or type its web address yourself, and see whether any account or plan exists under your email or phone number. If nothing is there, you may be looking at phishing. Forward it to your email provider as spam and report it to ReportFraud.ftc.gov.
If a plan is really there, or a collector has named a lender and an amount, carry on below. You may also be able to find your way to an account by checking your email for a sign-up message you did not expect.
Who to contact, and what to say
| Who | Why | What to say or do |
|---|---|---|
| The lender’s fraud team | Only it can close the plan and stop the billing | “I did not open this account or make this purchase. I am reporting identity theft. Please stop collection and confirm in writing.” Klarna, for example, has a customer service section with fraud topics |
| IdentityTheft.gov | The FTC says this creates a free recovery plan, with pre-filled letters to credit bureaus, businesses and debt collectors | Complete the report and save the PDF. Send it to the lender |
| Your bank or card issuer | The plan may be drawing on a card or account of yours | Ask whether the card was used without permission, and ask for a new number if so |
| Credit bureaus | To block new accounts | Place a freeze with Experian, TransUnion and Equifax separately |
| The merchant | It may be able to stop a shipment or tell you where the goods were sent | Give it the order number if you have one |
| Local police | Some companies request a police report | Ask for a report number if the lender needs one |
Keep a log of every call: the date, who you spoke with, what they said. Every written confirmation goes in the same folder.
Should I pay to make it go away?
Don’t pay until the lender has heard from you, even if the amount is small. A payment can look as if you accept the debt. If a real collector calls, tell them you dispute the debt as identity theft and ask for the details in writing. If a payment has already been taken automatically from your account, tell the lender and your bank that you did not authorize it.
What rights do I have with a BNPL lender?
This is a moving target. In May 2024 the CFPB issued an interpretive rule treating some BNPL lenders as card issuers for dispute purposes, but on May 6, 2025 the agency said it would deprioritize enforcement actions based on that rule and was considering rescinding it. We could not confirm the rule’s current status, so don’t count on it alone when you write to a lender. Lean on the identity theft report, which works regardless, and keep your wording simple: you did not open this account.
If a lender does not respond or insists you owe the money, send your complaint to the CFPB’s complaint portal and your state attorney general.
How did they get my details?
You may never know. Some common sources include a data breach, a phishing page you did not recognize as fake, or mail stolen from your box. If you remember a suspicious message around that time, our guides on a “refund ready, verify your account” message and on a “payment failed” email show the steps to take if you entered details somewhere.
Check the email account tied to your other logins as well. If it was compromised, the FTC’s recovery instructions will help you close that door, and a stranger’s forwarding rule can quietly keep a lender’s notices out of your inbox.
What about the goods?
If a package arrives that you did not order, photograph the label and tell the lender. You may have been used as a delivery address, with someone planning to collect it from your porch. Do not hand it over to a person who shows up asking for it, and contact the police if that happens. Our guide to packages you never ordered covers related situations.
Follow up on your credit file
The FTC’s identity theft guidance lists “accounts you don’t recognize” on credit reports as a warning sign, and says to check your reports regularly. A clean report may not show everything, so do not treat it as proof that no other plans exist. Ask each lender you have contacted whether any other plans exist under your name, phone or email.
A fraud alert is an extra option. It is free, it lasts one year, and it asks businesses to verify your identity before opening a new account; you only need to contact one bureau, and that bureau must notify the other two. If you need new credit during the holidays, remember to lift your freeze first.
Set a reminder for one month from now and another for three months. Check that the lender closed the plan in writing, that no new plans have appeared and that nothing went to collections.
Sources
- FTC, What to know about identity theft
- CFPB, Announcement regarding enforcement actions related to buy now, pay later loans (May 6, 2025)
- IdentityTheft.gov
- FTC, How to recover your hacked email or social media account
Found a factual error or a source that has changed?
Send a correction →
