Bank Fraud in LATAM, Seen from the Entity’s Side

Between January and May 2026, CONDUSEF received 34,325 claims against commercial banks for possible fraud, 18% more than in the same months of 2025. That figure counts only what reached the agency, not what banks receive.

From the entity’s side, a case like this usually starts earlier: an account holder reports that they do not recognize a transaction, someone records the report, and the entity has to decide whether to credit the amount, whether it can prove something, or whether its deadline has already expired.

For the entity that receives that report, the response in Mexico is distributed among the Bank of Mexico rule for card charges, the CNBV provisions, and the law that requires each entity to have a Specialized Unit. Chile serves as a contrast.

With a card, the Bank of Mexico rule makes the entity credit first and prove later. What it can prove, in our view, is what it recorded when authenticating, and that is the thread of this guide.

For the entity, bank fraud starts when the account holder disavows a transaction

CONDUSEF defines bank fraud by what the account holder challenges, regardless of the attacker’s technique. In its 2025 self-assessment report, it groups twenty-five causes of claim in which the account holder challenges “transactions they do not recognize having carried out”: unrecognized purchases, unrecognized electronic transfer, unrecognized charges to the account. From the entity’s side, the case exists from the moment the account holder disavows something that the system recorded as valid.

Within those causes, CONDUSEF isolates six that it treats as possible identity theft, including credit, a card, or an account granted without having been requested, and a contract that the user does not recognize having entered into.

An entity thus faces two different problems. In one, money leaves a legitimate account, which is the territory of account takeover. In the other, the account or credit is created in the name of someone who never requested it: it is identity impersonation at onboarding. We read that the first fails in authentication and the second in identity verification when opening the product; CONDUSEF does not make that distinction.

What is claimed most are purchases and transfers the account holder does not recognize

Purchases and transfers that the account holder does not recognize top the claims against banks for possible fraud. In 2025, CONDUSEF recorded 67,651 in the banking sector, 7.9% less than in 2024: 29,763 for unrecognized purchases and 13,631 for unrecognized electronic transfers. The year closed down and the 2026 increase runs in another window, so the two figures are not read as a trend.

CONDUSEF describes the modalities by technique (smishing by SMS, phishing that impersonates a financial institution, vishing by phone) and in May 2026 warned of an increase in attempts via SMS, messaging applications, and false links. It does not publish figures by modality: its statistics count the transaction the account holder disavows, and the technique used to obtain it goes uncounted.

Among the signs of phishing and smishing that the agency lists, there is one that matters on the entity’s side: “Sometimes they even ask you for the digits of your token.” What happens with a code handed over that way is seen in the card rule.

With cards, the entity credits first and proves later

When an account holder reports that they do not recognize a debit card charge, the Bank of Mexico rule requires the entity to credit it no later than the second following banking business day, if the report arrives within 90 days after the charge. It cannot ask the account holder for additional procedures, and it has to give them a reference number with the date and time of the report.

To reverse the credit, the entity has to demonstrate that the transaction was authenticated with at least two independent factors. It does so with an opinion signed by authorized personnel, within 45 days following the report (180 if the transaction was abroad), which includes at minimum:

• The evidence of the factors used and a simple explanation of how each one was verified.
• The hour and minute of the transaction.
• Who processed the transaction and the name of the payment recipient.
• The physical address of the device or the IP address, if the entity has it.

Without an opinion on time, the credit becomes final and cannot be reversed. Even with two factors, the entity credits if there is evidence of an operational failure attributable to it.

The rule accepts four types of factor: what only the account holder knows, such as the PIN; a device that only they possess, such as the chip; their own characteristics, with facial geometry among biometrics; and whatever the Bank of Mexico authorizes. Facial biometrics thus enters as one of the factors of multifactor authentication under the terms of the rule.

Credit cards follow the same structure in their own rules. Claims are also handled by the Specialized Unit that the law requires each entity to have. According to the text of the law in force after its January 2024 reform, it must respond in writing within a period of thirty business days.

If the account holder handed over their two factors under deception, for example by dictating the token code to someone posing as the bank, the transaction meets the two-factor condition, and the entity could uphold the opinion even though fraud existed. The Bank of Mexico does not formulate it this way: it is our reading of the text.

In a SPEI transfer there is no automatic credit

For a SPEI transfer that the account holder does not recognize, there is no automatic credit. The Bank of Mexico’s SPEI rules require banks to sign a collaboration agreement among themselves, with support requests to the bank that received the funds, mechanisms to restrict the beneficiary’s use of the resources, and a path to return them. If there are elements to presume that the order is possibly fraudulent, the receiving bank has to send a return.

We did not find the agreement published, so its deadlines cannot be cited. From the rule it follows that recovery depends on the money still being in the account that received it. What happens next is the territory of the money mule.

The CNBV imposes a credit within 48 hours only in limited cases: services that the entity offered with reduced requirements, such as mobile payment, and cards without a chip at ATMs and terminals. There, the entity agrees with the user that it assumes the risk of what the user does not recognize. Neither rule states it, but they share a logic: if the entity authenticates strongly, it can defend the transaction; if it authenticates lightly, it keeps the cost.

What the supervisor requires to be recorded is the same evidence that decides the claim

The CNBV provisions require the entity to authenticate with factors and to record in a log the time, the device, and the IP of each transaction, in addition to each unrecognized transaction. They are, in our view, almost the same data requested by the Bank of Mexico opinion. What they require:

• Authentication factors in four categories; the fourth is biometric and names facial recognition.
• To remotely contract certain accounts and loans, verify the applicant’s biometrics against INE records or another authority.
• Notify the customer of each contract and each transaction made in their name.
• Controls to detect what deviates from the user’s usual use.
• Logs with date, time, accounts, access device, and IP address.
• A record of each unrecognized account or credit, with the identification requested at contracting and the loss that the entity would absorb.

Since the June 2024 reform, each bank also has a Fraud Prevention Management Plan approved by its CEO, and processes that assess the effectiveness with which it resolves monetary claims.

Crossing the two regulations leaves a concrete proof for any transaction today: if a report arrives tomorrow, the entity needs to have at hand the factors with which it was authenticated, the hour and minute, and the device or the IP.

Chile already distinguishes between factors: with a biometric one, who has to prove changes

Chile resolves the same question with a law, 20.009, which places the burden of proof on the issuer: when the user disavows a transaction, the issuer has to prove that it was authorized, and the record alone is not necessarily enough. Unlike the Mexican credit rule, it also reaches transfers.

The May 2024 reform added a presumption: willful misconduct or gross negligence by the user is presumed when the transaction was made with enhanced authentication and at least one inherence factor, that is, biometric. With only possession or knowledge factors, the transaction serves merely as the basis for a judicial presumption. In Mexico, biometrics is a valid factor among others; in Chile, it changes who has to prove.

What VU does

The VU capability that provides context about the device is Protect against fraud, with recognition of the device from which the transaction is carried out based on browser and mobile signals. The decision about what to do with that signal, and the monitoring of the transaction, are resolved in another layer that VU does not provide. Learn about fraud prevention (Protect).

With a debit card, in our view, the claim is decided by the evidence that the entity kept when authenticating, unless there is an operational failure attributable to it.

If you work at an entity and want to review what authentication evidence you have today per transaction, before a report puts it to the test,
schedule a conversation.