Background: Zip and buy now, pay later

Buy now, pay later (BNPL) has become one of the most recognisable products in modern retail finance. The idea is simple: instead of paying the full price of a purchase upfront or putting it on a credit card, a shopper splits the cost into several interest-free instalments paid over weeks or months. The BNPL provider pays the merchant immediately and collects from the customer later, earning money from merchant fees and late-payment charges. Australia's Zip Co is one of the largest BNPL businesses in the world, with operations in Australia and a fast-growing presence in the United States.

The business model depends on scale and trust. Providers process millions of small transactions, and their profitability hinges on keeping credit losses — money never collected from customers — within a narrow target range. Because growth is the engine of the model, any event that slows new-customer sign-ups or transaction volumes hits investors hard. That is exactly what happened to Zip this week.

The fraud risk is especially acute for BNPL providers because of how accounts are created. Unlike a traditional credit card, which typically requires a detailed application, a credit history check and days of processing, BNPL accounts can often be opened in minutes at checkout. That speed is the product's main selling point — but it also gives fraudsters a fast lane. The coordinated nature of this attack, with actors using legitimate credentials to create accounts, suggests an organised effort rather than opportunistic abuse, which is why analysts questioned whether Zip's onboarding controls are strong enough to catch such schemes before losses pile up.

What happened on Friday

On Friday, October 23, 2026, Zip Co released its fiscal first-quarter trading update and disclosed that it had "identified and contained" an external fraud incident in its US business during the quarter. The company said coordinated actors had opened new accounts using legitimate credentials to execute unpaid transactions — a form of fraud that is particularly difficult to detect, because the credentials themselves appear genuine.

The incident weighed on total transaction value (TTV) and new-customer growth in July and August, as Zip applied containment measures that temporarily slowed sign-ups and transactions. It also cost the company A$10.1 million in cash operating expenses. Zip said it had notified the relevant authorities and lodged a claim with its insurer.

Investors reacted savagely. Zip shares plunged as much as 50.5% intraday to A$1.025 — their worst single session on record and their lowest level in more than two years — erasing about A$1.3 billion from the company's market value before they pared some losses. They closed Friday at A$1.46, down 29.5% from Thursday and down 63.6% year-to-date.

Why it matters

The scale of the sell-off tells the story: the fraud was not enormous in dollar terms — A$10.1 million against quarterly TTV of A$4.6 billion — but it struck at the questions investors most wanted answered. Analysts at Citi said the incident "raises concerns on Zip's onboarding controls," while Jefferies said investors needed greater clarity on whether the increase in operating expenses would persist and how the company plans to prevent similar incidents in future.

Credit performance added to the worry. Group net bad debts rose to 1.93% of TTV in the quarter ended September 30, above UBS's estimate of 1.8%, with US bad debts reaching 1.93% — near the top of management's 1.5%-to-2% target range. Meanwhile cash earnings before tax, depreciation and amortisation (EBTDA) rose only 3.4% to A$65 million despite an 18% rise in TTV, suggesting growth is not yet translating strongly into profit. For investors who want BNPL providers to prove the path to sustainable earnings, higher credit losses and unexpected expenses make that harder to believe.

The timing is also awkward. Zip's US operations president, Joe Heck, resigned earlier this month and was replaced on an interim basis — a leadership change that now sits alongside the fraud disclosure and may draw extra attention.

Key facts

  • Zip shares fell as much as 50.5% intraday and closed down 29.5% at A$1.46, the worst session in the company's history.
  • The sell-off erased about A$1.3 billion from Zip's market value; shares are down 63.6% in 2026.
  • The fraud involved coordinated actors opening new US accounts with legitimate credentials to make unpaid transactions; it hit TTV and customer growth in July and August.
  • The incident cost A$10.1 million in cash operating expenses; Zip notified authorities and lodged an insurance claim.
  • Group net bad debts rose to 1.93% of TTV, above analyst expectations; TTV still grew 18% to A$4.6 billion.
  • Zip kept its full-year cash EBTDA guidance unchanged and said US growth returned in September, with positive momentum into October.

What happens next

Zip's defence is that the worst is contained: the incident was identified and contained, TTV strengthened in September with 41% year-on-year growth in US-dollar terms, and momentum continued into October. The company kept its full-year cash EBTDA guidance unchanged, signalling confidence that the fraud was a one-off rather than a structural problem. Chief executive Cynthia Scott sounded upbeat about the holiday season, when BNPL usage typically surges.

Investors, though, will be watching three things: whether onboarding controls can be shown to be fixed, whether bad-debt ratios stabilise or climb further toward the top of the target range, and whether the insurance claim recovers any of the A$10.1 million. With the stock down more than 60% this year, the market is pricing in deep scepticism — and Zip's next quarterly update will be its best chance to change that story.

The episode also raises broader questions for the BNPL sector. Regulators in several countries have been tightening oversight of buy now, pay later products in recent years, arguing that light-touch credit can leave consumers overextended. A high-profile fraud event will only add fuel to those debates, and it may push other providers to audit their own onboarding systems. For Zip, though, the immediate priority is narrower: proving that the containment held, the insurer pays out, and September's recovery was real — not a one-month bounce.

For wider context on financial-sector pressure, see our coverage of Bank of America's earnings hit, the Getty Images bankruptcy deal, and cyberattacks on financial institutions in India. For the crypto side of digital payments, see our explainer on bitcoin's 2026 rally.

Sources: Reuters, AAP, Oct 2026.