Banking Fraud on the Rise in Mexico: The Cost to Users and the Challenge for Banks
The uptick in digital scams and identity theft is pushing banks and regulators to tighten controls, but user education remains decisive.
Fraud against users of financial services in Mexico continues on an upward track and is increasingly becoming a factor that erodes trust in digital payment methods. So far this year, bank-related fraud has grown 17%, with average losses for victims typically ranging between 20,000 and 50,000 pesos, according to figures and interviews gathered across the industry. The impact is significant at a time when the country is accelerating the use of electronic transfers and online shopping, and when financial digitization has expanded faster than a culture of prevention.
Between January and June, the National Commission for the Protection and Defense of Users of Financial Services (Condusef) received 118,287 complaints; of those, 43,871 were related to traditional fraud, online fraud, and identity theft. Notably, 14,267 cases—about 32% of fraud complaints—correspond to online incidents tied to transfers and electronic purchases, categories growing in step with the adoption of mobile banking and digital commerce.
In practice, the modus operandi relies on social engineering: calls and messages impersonating the bank, alerts about “unauthorized charges,” and pressure tactics to get the user to share passwords, verification codes, or even install apps that enable remote control of the phone. Pedro Villanueva, head of Banking Security and Protection (Seproban), has warned that older adults account for a meaningful share of cases, as they are a group criminals can more easily persuade using urgency and supposed “assistance” tactics.
Beyond the direct theft of funds via transfers, fraud from unauthorized merchant charges remains persistent. In these cases, the average amounts tend to be smaller—between 3,000 and 5,000 pesos—but their frequency increases operating costs for issuers, merchants, and payment networks, and puts pressure on dispute-resolution processes. In an environment of tight margins and intense competition for digital customers, the cost of prevention and claims handling has already become part of the “price” of financial transformation.
More Controls: Biometrics, Transaction Limits, and Intelligent Monitoring
The financial system’s response has been to raise barriers without fully undermining the digital experience. In recent years, tools such as geolocation within banking apps have been added to reduce attacks originating from unusual locations, and both transactional and non-transactional monitoring has been strengthened for accounts with high balances or vulnerable profiles. Banks have also sought to contain losses through user-configurable limits: the so-called User Transaction Amount (Monto Transaccional del Usuario, or MTU) allows caps on transfers, withdrawals, and other movements, aiming to limit the damage when a customer is tricked and the criminal has already gained access to the account.
More recently, a regulation took effect that raises the identification standard for high-value transactions: anyone seeking to withdraw or transfer more than 140,000 pesos must authenticate using fingerprints or facial recognition. For the industry, biometrics serve as an additional “lock” against identity impersonation; for users, it means an extra step that can reduce friction for large transactions if implemented with clear standards for availability, personal data protection, and operational capacity in branches and across digital channels.
This trend is unfolding as Mexico promotes policies aimed at financial inclusion and broader use of electronic payments. The growth in transfers, the expansion of e-commerce, and the preference for mobile banking broaden the attack surface: the more transactions go digital, the more attractive human “failure points” become—shared passwords, codes read out over the phone, clicks on fake links. Add to that data leaks or data resale practices, and the increasing sophistication of criminal networks that segment victims by age, location, and spending habits.
The industry argues that some containment happens before the damage becomes irreversible. Specialized prevention teams apply preventive blocks when they detect unusual patterns, such as chained transfers, atypical additions of beneficiaries, or logins from unrecognized devices. Still, the challenge is structural: security does not depend solely on the bank, but on a triangle of institutions, authorities, and users—especially when fraud is carried out through deception rather than a technical breach of the system.
To improve response capacity, Seproban and Condusef launched the “Consulta y Reporta” tool, designed to identify and report phone numbers associated with potential fraud. In its first weeks, it logged more than 11,000 searches and nearly 5,000 numbers reported, suggesting real demand for simple tools that can cut off the scammer’s first contact with the victim, which is often the initial call or message.
Looking ahead, the economic impact of banking fraud will remain on the agenda for three reasons: first, payment digitization is not going to stop; second, the cost of disputes and chargebacks puts pressure on banks and merchants; and third, user trust is a key asset for deepening financial adoption. The combination of biometrics, transaction limits, and risk analytics can reduce losses, but without financial education and basic security habits—verifying phone numbers, not sharing codes, being skeptical of urgency, and using card controls—the growth of scams will continue to find fertile ground.
Overall, the rise in fraud reflects a race between financial innovation and the evolution of crime: new barriers help, but day-to-day user prevention and institutional coordination will be decisive in containing the problem without slowing digitization.
