Stopping Emerging BNPL Fraud Rings in Real Time

Background

A large payments infrastructure provider powers card-based transaction processing for a broad ecosystem of downstream fintechs and financial institutions. As their customer base grew, so did the urgency: fraud patterns shifted faster, clients demanded quicker responses, and internal teams were expected to protect more volume with the same headcount.

At the same time, leadership saw a strategic opportunity. If they could modernize fraud decisioning and package it as a white-labeled platform, risk would stop being a cost center alone, and start becoming a differentiated, revenue-generating service for their customers.

Challenge

The team’s mission was clear: stop fraudulent BNPL/loan applications in real time without disrupting legitimate customers at the moment of purchase. In practice, that meant protecting a high-scale, high-velocity decision flow where latency and accuracy directly affected approvals, losses, and customer experience. 

They already had internal rules engines and supervised machine learning models, but these methods were increasingly strained by emerging, coordinated fraud patterns—especially fraud rings designed to evolve faster than labeled-data-driven systems could keep up. A prior clustering-based approach had also proven costly and difficult to maintain, adding operational drag precisely when the threat landscape demanded speed and adaptability. 

• Needed to identify fraudulent BNPL/loan applications in real time at high scale.
  
  
• Existing rules + supervised ML struggled with new, evolving, and coordinated fraud ring attacks.
  
  
• A previous clustering model was expensive and difficult to maintain.
  
  
• Required protection against emerging patterns without relying on labels or frequent retraining, reducing exposure to model decay.
  
  
• Required ultra-low latency to support instant checkout and enable auto-decisioning without harming customer experience.

‍

Solutions

To break the cycle of chasing yesterday’s fraud, the provider deployed DataVisor’s unsupervised machine learning (UML) to detect fraud without labeled data—strengthening their ability to identify novel attacks and coordinated rings that were not well covered by supervised approaches alone. 

Just as importantly, the solution was built to operate at checkout speed: ultra-low latency scoring was integrated into the BNPL flow so the business could confidently automate decisions in real time, instead of pushing risk downstream into manual review and delayed remediation. As the program matured, the team also validated scalability with a ~6–8 week build-and-deploy cycle for a new market model as expansion was tested. 

• Deployed Unsupervised Machine Learning (UML) detection to capture fraud without labeled data, improving resilience to novel patterns and rings.
  
  
• Integrated ultra-low latency scoring into the checkout decision flow to enable real-time auto-decisioning.‍
  ‍
• Demonstrated scalable model development, with a documented ~6–8 week build/deploy cycle for a new market model during expansion testing.
  ‍

Results

With DataVisor in place, the BNPL provider shifted from reactive defense to proactive protection—improving fraud outcomes while streamlining operations in the moments that matter most: real-time decisions at checkout.