BNPL - Security with Unzer

Risk-based two-factor authentication for your BNPL checkout.

Unzer will introduce a risk-based two-factor authentication for BNPL checkout starting in May 2026. The risk-based identity check will only be triggered when it matters and remains invisible when it is not necessary.

If you are already a customer of Unzer and have questions about 2FA, feel free to contact our support team.

Less fraud. More approved transactions. No unnecessary friction.

Why 2FA with BNPL?

Buy Now, Pay Later carries real risks. Identity fraud, payment defaults, and cases of 'buy now, never pay' cause direct losses — for merchants and for us. Traditional risk scoring works well in clear-cut cases, but a large gray area of uncertain transactions is either rejected outright or goes through unchecked. We close this gap.

Starting in May 2026, Unzer BNPL will introduce risk-based two-factor authentication. It does not create additional friction at every checkout — only for transactions where an increased risk is detected. For all others, the checkout will continue just as it does today.

This is how it works

Our risk engine evaluates every transaction. The result determines the further course of action:

  • Clearly approved — transaction will be authorized immediately. No additional step.
  • Uncertain / Soft Decline — The customer is asked to verify their identity. One step, several methods, seamless experience.
  • Hard Decline — The transaction will be declined. Same as it is today.

The verification method is automatically selected based on the risk level — or the customer can choose their preferred option themselves.

Overview

Our risk engine evaluates every transaction. The outcome determines the path:

  • Clear pass — Transaction approved immediately. No additional step.
  • Uncertain / soft decline — Customer is prompted to verify their identity. One step, multiple methods, seamless experience. 
  • Hard decline — Transaction rejected. Same as today. 

The verification method is selected automatically based on risk level — or the customer can choose their preferred option.

Three Ways to Verify

SMS-OPT

A one-time code that is sent to the phone number registered by your customers. Fast, familiar, smooth.

Bank-Login (Open Banking / AIS)

Your customers verify themselves through their own bank account. A strong identity signal without the need to manage new login credentials.

Photo-Ident

ID document plus selfie for high-risk transactions. Reserved for cases where this is necessary.

What this means for your company

Less losses

Identity fraud and payment defaults weigh on your results. A verified identity exactly at the moment of risk changes that.

More approvals

Uncertain transactions that would have otherwise been rejected can now be verified and approved. This is revenue that would have previously been lost.

No interruption

If you use the Payment Page or plugins (Shopify, Shopware, Magento), you will be automatically updated on 05.05.2026. You do not need to configure anything.

Regulatory preparation

2FA meets current and upcoming consumer protection requirements, including CCD2. You are covered

Made for the future

Fraud is one of the biggest structural threats to BNPL as a payment method. 2FA is not a stopgap solution — it is the foundation for expanding BNPL into categories where it has not been viable so far: digital goods, travel, luxury, high-end electronics.

The goal is not just less fraud. It is about a more trustworthy, more easily approvable, and more sustainable BNPL ecosystem.

If you are already a customer of Unzer and have questions about 2FA, feel free to contact our support team.

Frequently Asked Questions about Two-Factor Authentication

FAQ – 2FA in the Unzer BNPL Checkout

When will 2FA be introduced?

What is the new 2FA in BNPL checkout?

Why is Unzer introducing 2FA?

Is 2FA applied to every transaction?

What advantages do I have as a merchant?

What verification methods are available?

How is the verification method selected?

Do I have to do anything as a merchant?

What happens if I make no adjustments?

Does 2FA affect my conversion rate?

Is Unzer support available to me – even if I am working with an agency?