# Testing checklist: buy now pay later service

Source: https://howtotestaproduct.com/how-to-test/bnpl-service/
Generated: 2026-10-07. Licence: CC BY 4.0.

- [ ] 1. release smoke tests
  - Done when: After each release, a test shopper completes a pay-in-four checkout on a test merchant and sees four instalments with the right dates in the app.
  - Risks: money-loss
  - Tool class: browser automation. Usually run by: QA engineer.
- [ ] 2. penetration testing
  - Done when: An external tester cannot view another shopper's purchases by changing an order ID, and cannot open a plan that bypasses the identity check.
  - Risks: data-breach, fraud-abuse
  - Tool class: proxy. Usually run by: external lab.
- [ ] 3. unit tests
  - Done when: Instalment split, rounding of the last instalment and late-fee caps match a reviewed table for each plan length and currency offered.
  - Risks: money-loss
  - Tool class: unit framework. Usually run by: developer.
- [ ] 4. integration tests
  - Done when: A refund, a partial capture and a cancelled order sent through the merchant API each change the shopper's plan in the app to the matching amount.
  - Risks: money-loss
  - Tool class: API client. Usually run by: developer.
- [ ] 5. contract tests
  - Done when: A merchant plugin release that changes the refund or capture message fails a contract check before it reaches merchants.
  - Risks: money-loss
  - Tool class: contract tool. Usually run by: developer.
- [ ] 6. payment and money-flow testing
  - Done when: In the sandbox, a full refund from the merchant cancels all unpaid instalments and a partial refund reduces them, with no further autopay charge.
  - Risks: money-loss
  - Tool class: API client. Usually run by: QA engineer.
- [ ] 7. end-to-end functional tests
  - Done when: A test shopper whose stated income fails the affordability rule is declined at checkout, and the decline is logged with the check that failed.
  - Risks: regulatory-penalty
  - Tool class: browser automation. Usually run by: QA engineer.
- [ ] 8. compliance checks
  - Done when: For a sample of plans, a reviewer finds the pre-contract information, the missed-payment notice and the hardship option the shopper was shown, each stored with a date.
  - Risks: regulatory-penalty
  - Tool class: test management. Usually run by: product manager.
- [ ] 9. security scanning
  - Done when: The latest scan of the shopper app, merchant portal and checkout API shows no open finding that returns another shopper's data.
  - Risks: data-breach
  - Tool class: DAST scanner. Usually run by: security specialist.