Multiple Faces Detected
March 6th, 2026
Afterpay promised to make shopping simpler. Split any purchase into four payments, no interest, no credit check. Millions of people use it every day at Nike, Sephora, and thousands of other retailers.
But convenience attracts criminals just as fast as it attracts customers.
Fraud targeting Afterpay has surged in 2025. Scammers are opening accounts in other people’s names, phishing for login credentials, and running coordinated schemes that leave real users holding the bill. The platform itself is legitimate; the threats come from the people exploiting it.
If you use Afterpay, or you have never signed up but recently received a verification code from them, you need to know what is happening right now.
Not sure if your identity has already been used to open an account? Run a search on Social Catfish to check what is out there under your name.
What Is Afterpay and Why Do Scammers Target It?
Afterpay is a buy now, pay later (BNPL) service owned by Block Inc., the same company behind Cash App. It lets shoppers pay for purchases in four interest-free installments over six weeks. Signing up takes minutes and requires no hard credit check, which is exactly what makes it appealing to users and exploitable by fraudsters.
Security experts have long pointed out that BNPL platforms have weaker controls than traditional banks and credit card companies. Fintechs are fast-growing and prioritize frictionless onboarding, leaving gaps that criminals exploit. Afterpay says it has extensive fraud processes in place and that fraud losses represent less than 1% of its global sales, but that still amounts to significant real-world harm for individual victims.
The Afterpay Scams Hitting Users in 2026
Phishing Emails and Texts
This is the most common Afterpay scam currently in circulation. You receive an email or text that looks exactly like an official Afterpay notification, with the same logo, same formatting, same tone. The message says your account has been restricted, a payment has failed, or your details need to be confirmed. There is a link. You click it. The site harvests your login credentials, one-time passcode (OTP), and sometimes your full card details in a single session.
What makes this particularly effective is the urgency. These messages are designed to trigger panic. The moment you think your account is about to be suspended or a payment is about to default, your defenses drop.
Afterpay will only ever email you from afterpay.com. Any other domain, no matter how convincing, is a fake. Never click links in these messages. Go directly to the app or type the URL manually.
Someone Opening an Account in Your Name
This one catches people completely off guard. You receive a “Welcome to Afterpay” email for an account you never created. Or you get an unsolicited OTP text from Afterpay even though you have never used the service.
This is new-account fraud using stolen identity data. Criminals piece together your name, email address, and physical address from data breaches, then register an Afterpay account with a phone number they control. All login codes and verification texts go to them. The account gets used for purchases. You find out when payments start hitting a linked card or when you notice the welcome emails.
Fraud-prevention vendors reported a significant spike in this type of synthetic identity misuse across BNPL platforms in 2025, with AI making it easier to generate multiple fraudulent profiles quickly.
If you receive Afterpay emails you did not trigger, treat it as identity theft immediately, do not wait to see what happens next.
The Merchant-Consumer Collusion Scheme
This is a newer and less publicized scam that Afterpay’s own executives flagged at a major fintech conference in late 2025. Fraudulent merchants sign up for Afterpay, then work with accomplices posing as customers to create fake transactions. The “customer” makes a purchase, claims they never received the goods, and demands a refund, then both the fake merchant and fake consumer disappear. Afterpay is left with the loss.
Why does this matter to you as a shopper? These operations use synthetic identities built from stolen consumer data, including Social Security numbers. Your personal information could be part of the foundation of one of these schemes without your knowledge.
Account Takeover
If a scammer gets hold of your Afterpay login through a phishing attack, a data breach, or credential stuffing, they can take over your account and start making purchases immediately. Your payment method is already on file. They do not need your card number. They already have it.
Signs your account may have been compromised include unfamiliar orders in your transaction history, unexpected payment notifications, or being locked out of your own account.
Fake Stores That Accept Afterpay
Some scammers build convincing fake online stores that display the Afterpay logo at checkout. You shop, select Afterpay as your payment method, complete the transaction, and nothing arrives. The store disappears. Your money is gone, and Afterpay has no record of a legitimate merchant to refund you from.
Before buying from an unfamiliar online retailer, search the store name alongside “scam” or “reviews” before you complete the purchase. If the site launched recently, has no verifiable contact information, or appears on fraud forums, walk away.
Red Flags to Watch For
You receive an Afterpay email or text that you did not initiate. A welcome message, an OTP, an order confirmation if you didn’t trigger it, and someone else is using your information.
The message creates urgency. Real Afterpay communications do not threaten immediate account closure or demand you verify your identity within minutes. Urgency is a manipulation tactic.
The email address is not from afterpay.com. Check every character. Scammers use domains like afterpay-support.com or afterpay-secure.net that look plausible at a glance.
You are asked for your verification code by phone. Afterpay will never call you and ask you to read back an OTP. If this happens, hang up. The caller is trying to complete an account takeover in real time.
An online store accepts only Afterpay, with no other payment options. Legitimate retailers offer multiple payment methods. A site that pushes Afterpay exclusively and has no other footprint online is a warning sign.
How to Protect Yourself
Use the official app, not links from messages. Always access your Afterpay account by opening the app directly or typing afterpay.com into your browser. Never click links from emails or texts, even if they look real.
Enable strong authentication. Use a unique password for your Afterpay account that you do not use anywhere else — and enable any available two-factor authentication.
Check your transaction history regularly. Catching unauthorized purchases early gives you the best chance to dispute them and limit your exposure.
Monitor your name and email online. If your data has been used to open a fraudulent Afterpay account, there may be other accounts opened in your name across other platforms. Run your name, email, or phone number through Social Catfish to see what is linked to your identity across the web and catch misuse before it escalates.
Place a fraud alert if you suspect identity theft. Contact one of the three major credit bureaus, Equifax, Experian, or TransUnion, and request a fraud alert. This makes it harder for scammers to open new accounts in your name anywhere.
What to Do If You Have Already Been Scammed
If you believe you have been targeted or your Afterpay account has been compromised, act immediately.
Contact Afterpay’s support team through the official app or website and report the fraudulent activity. Document everything, screenshots of the messages, transaction records, any phone numbers or email addresses involved.
Call your bank or card provider and report unauthorized charges. Some transactions can be reversed if you act quickly.
File an identity theft report with the FTC at IdentityTheft.gov. The site walks you through recovery steps specific to your situation.
Report the scam to the FBI’s Internet Crime Complaint Center at IC3.gov.
If your Social Security number may have been compromised, place a credit freeze with all three bureaus to prevent new accounts from being opened in your name.
FAQ
Yes. Afterpay is a legitimate buy-now, pay-later platform owned by Block Inc. and used by millions of shoppers at major retailers worldwide. The fraud risks come from scammers exploiting the platform’s popularity, not from Afterpay itself.
This is a strong signal that someone is attempting to open an Afterpay account using your information or is trying to take over an existing account. Do not share the code with anyone. Contact Afterpay directly through the official app and report what happened.
Change your Afterpay password immediately, then change the passwords for any other accounts that use the same credentials. Contact Afterpay’s fraud team, notify your bank, and monitor your accounts for unauthorized activity. File a report with the FTC if your financial information was exposed.
Yes. Fraudsters use stolen personal data, names, email addresses, and physical addresses to open BNPL accounts with a phone number they control. Social Catfish can identify who’s really behind that profile.
Afterpay will investigate fraudulent transactions on legitimate accounts. However, if you purchased from a fake third-party store, the protections are more limited. Your best recourse in those situations is to dispute the charge directly with your bank.
The Bottom Line
Afterpay is a real, widely used service. The problem is not the platform, it is that scammers have learned exactly how to exploit the trust and speed that make BNPL services appealing. Phishing attacks, identity theft, fake merchants, and account takeovers are all active threats in 2026.
Staying safe means being skeptical of any message you did not initiate, monitoring your accounts consistently, and knowing what your identity looks like online.
Search your name and email on Social Catfish to find out if your information has already been used to create accounts you did not open.
