- In Mexico there is no autonomous federal crime of identity theft. It is defined in local criminal codes, each with its own name (identity usurpation, article 211 Bis, in Mexico City), and the Law on Credit Institutions punishes obtaining a financial product with an impersonated identity.
- The 2025 personal data law requires informing the data subject "immediately" of a breach that significantly affects their rights (article 19).
- NIST SP 800-63A-4 (July 2025) prohibits verifying identity with questions about personal data.
- In certain in-person operations with a voter ID card, the CNBV requires banks to verify against INE records the card’s data and the biometrics of the person presenting it (article 51 Bis 4).
On March 28, 2018, the General Council of the National Electoral Institute (INE) fined two political parties for the improper use of the Voter List. In one of the cases, the copy delivered to the party had been left visible on the internet, on an Amazon portal. Councilor Murayama summed it up this way: "here we are sanctioning the negligence, not the consequence of that negligence".
For a company that opens accounts or grants credit in Mexico, the case leaves a working premise: the data with which a customer identifies themselves may be in someone else’s hands before they reach onboarding.
In Mexico, identity theft is not a single crime
In Mexico there is no single crime of identity theft: each state that defines it gives it its own name and penalty, and at the federal level the specific offense is in the Law on Credit Institutions.
In Mexico City it is called identity usurpation. Article 211 Bis of the Criminal Code, in force with amendments as of August 21, 2026, punishes with imprisonment and day-fines anyone who "by any means usurps, for illicit purposes, the identity of another person", and also anyone who consents to having their own used: the figure of the front person. The penalty increases if the perpetrator relies on having the same name, a physical resemblance, or a similar voice.
At the federal level, article 112 Septimus of the Law on Credit Institutions, added in 2018, punishes with imprisonment and a fine anyone who uses or obtains "any financial service or product" from an institution "under a false or impersonated identity", and anyone who lends their own identity to do so. There, the party deceived is the institution itself.
The Federal Criminal Code does not have an autonomous offense. This is acknowledged by an initiative presented in the Chamber of Deputies in February 2026, which is also the source for the fact that most state legislatures define it as theft, impersonation, or usurpation of identity. There are initiatives in Congress to create the federal crime.
Outside the financial system, the closest federal offense is, in our view, article 63 of the 2025 personal data law: it punishes anyone who, to obtain undue profit, processes personal data through deception, taking advantage of the data subject’s error.
We discuss the difference between theft and identity impersonation on its own page.
Your customers’ data has already circulated
A company operating in Mexico has to assume that its customers’ identification data may circulate outside its control. The INE maintains that the Electoral Register database was never breached and attributes the leaks to external agents, and even so a copy delivered to a third party ended up exposed on the internet. In 2020 it sanctioned another case: an attempt to sell the 2015 Voter List online in 2018.
CONDUSEF defines a person’s identity with a broad list: "name, telephone, address, photographs, fingerprints", identification credentials "as well as any other data that allows a person to be identified".
Data that circulates ceases to be secret. An onboarding process that only checks that the name, address, and identifiers match each other will line up with the data of a real person, even if someone else is the one typing them in.
Knowing the data does not prove who you are
The reference technical standard no longer accepts knowledge of personal data as proof of identity. NIST SP 800-63A-4, the guide from the United States National Institute of Standards and Technology, published on July 31, 2025, says it this way: "Knowledge-based verification (KBV) or knowledge-based authentication SHALL NOT be used for identity verification." It only allows those questions as a signal within a fraud management program.
NIST does not explain the prohibition through leaks. The connection is ours, and it is supported by the same text: its basic level, IAL1, is designed "to protect against synthetic identities and attacks using compromised personal information", that is, against synthetic identities and attacks using compromised personal information.
Instead, verification has to ensure that whoever presents the evidence is its legitimate owner. One accepted method is to automatically compare the face on the document with that of the person. If the capture is remote, NIST requires presentation attack detection in accordance with ISO/IEC 30107-3:2023, to confirm that there is a live person in front of the camera: what the market calls liveness detection.
NIST also acknowledges the limit: against injection and deepfakes, live capture and presentation attack detection "do provide some protection", but they do not cover every case.
The guide is mandatory for United States federal agencies and not for Mexican companies, which may take it as a technical reference.
Mexican banking already verifies against the source and against the person
For credit institutions, the CNBV applies a similar criterion through its own regulation: the credential’s data is checked against the registry that issued it, and the biometrics against the person who appears.
In certain in-person operations with a voter ID card, article 51 Bis 4 of its provisions asks that two things be verified online against INE records: the card’s data, such as the CIC and the name, and the biometric information of the person presenting it, with a minimum matching threshold set by the regulation. The capture has to obtain the biometrics "directly from the data subject", avoiding that of a mechanism that simulates another person.
A resolution of July 1, 2026 added facial biometrics to in-person verification, which until then had been done with the fingerprint.
In the remote contracting of certain accounts and loans, article 51 Bis 6 requires verifying the applicant’s biometrics against the INE, the Ministry of Foreign Affairs, another authority that provides that service, or the institution’s own biometric database.
These rules are for banks, not for every company. They show a criterion: validate against the source that issued the data and check that the person present is its holder.
If the leak is yours, the law asks you to notify
If a breach in the company’s database significantly affects people’s property or moral rights, the law requires informing them immediately. It is the Federal Law on the Protection of Personal Data Held by Private Parties, published on March 20, 2025, which replaced the 2010 law and transferred sanctions to the Ministry of Anti-Corruption and Good Government.
Article 18 requires administrative, technical, and physical security measures proportional to the risk and the sensitivity of the data. Article 19 orders that breaches "shall be informed immediately by the controller, so that [the data subject] can take the corresponding measures to defend their rights". The notice goes to the data subject; the article does not mention the authority or set a deadline in hours.
The content of the notice was detailed by the 2011 Regulation of the previous law: nature of the incident, compromised data, recommendations to the person, corrective actions, and where to get information. We did not confirm that it still applies, so take it as a good practice.
The law also defines as an infringement "breaching the security of databases" when attributable to the controller, with fines in Units of Measurement and Updating that may increase with sensitive data. The reading is ours: with the INE case in mind, the law punishes the same thing Murayama pointed out, the failure to safeguard, even if there has not yet been harm.
What VU does
Verify reads the document, compares the face with the one on the document, and applies liveness detection in the same flow, so verification rests on the person as well as the data.
ISO/IEC 30107-3 defines the method, the metrics, and how a presentation attack detection test is reported. The degrees of sophistication of the attack are not defined by the standard: they are defined by iBeta’s testing program, which applies that methodology and orders them by what it costs to build the instrument, in time, expertise, and equipment. There are three. What VU has evaluated is facial liveness detection, at Level 2 of that program.
let’s talk about your onboarding.
