Latin America Leads AI Synthetic ID Fraud

Operation Timeline

Attack Chain and TTPs

The chain described in the consolidated material follows a recognizable, though not linear, pattern. First comes the collection of inputs. Fitzpatrick points to identity fragments taken from data breaches and illicit markets. The same analysis adds that attackers can combine that information with AI generation of faces, documents, and fake work histories. Vijay Malhotra, citing the I4C alert in India, adds another source of training, social engineering, fake job interviews, video calls, and online public content reused to clone faces and voices. In other words, the input no longer depends only on a large-scale leak. It is also fed by everyday exposure and publicly available material.

The second step is building the synthetic identity. Revista Selecciones explains it in simple terms, criminals do not impersonate a specific person, but manufacture a new identity from legitimate fragments and false data. The Instagram reel on financial fraud reinforces the idea, the fraudster does not steal an existing identity, but creates a new combination to deceive verification systems. At this stage, the profile has to look coherent. That coherence is what allows it to pass initial filters and sustain the deception during maturation periods.

The third step is bypassing remote controls. DuckDuckGoose.ai identifies three technical routes, using AI-generated faces on forged documents, presentation attacks with deepfake video shown to the camera, and video injection attacks through virtual cameras. Veriff completes the picture by warning that attackers deliberately target the API junctions of legacy verification systems. The operational conclusion is straightforward, systems designed as discrete checkpoints can be bypassed if the attacker controls the visual input, the video stream, or the integration between services.

The fourth step is building history. Fitzpatrick explains that attackers often open low-risk accounts to create a behavioral footprint before applying for credit or higher-value products. That movement resembles identity grooming. Synthetic identity does not aim to exploit everything immediately. It appears as just another customer, builds reputation, earns algorithmic trust, and only then enters the monetizable phase. That behavior explains why losses can appear long after the initial onboarding event.

The fifth step is monetization. The material mentions high-value loans, financial products, online purchases, instant transfers, loans to third parties, fraudulent investment schemes, and payment fraud. In Brazil, Exame documents calls to family members using cloned voices to trigger urgent transfers and investment campaigns with deepfake celebrities tied to Pix. In Colombia, Blu Radio and El Tiempo describe fake audio or video used to request money in the name of relatives or employees. In Bolivia, several official alerts focus on messages requesting credentials, while educational content warns about extortion using AI-generated video. The vector changes, but the monetization pattern remains the same, extracting money or enabling fraudulent access to financial products.

The full sequence shows a mix of automation and patience. This is not always a "fast" fraud. In several examples, the attacker accumulates signals, tests the response of the victim or the system, builds profiles, and only then launches the monetizable event. That is why defenses that only look at the moment of account creation are insufficient. The problem extends to the continuity of identity, not just a single point of entry.

Regional Impact

Regional Overview

The cross-cutting reading of the corpus is that the region is no longer debating whether AI-driven synthetic fraud exists, but how quickly it is industrializing. The 48.3% attributed to Latin America by Unico and Liminal is disproportionate relative to the rest of the world and places the region as an exposure laboratory. That position has an operational counterpart. Remote onboarding environments, the expansion of fintechs, payment digitization, and the mass adoption of app- or messaging-based service channels create surfaces that attackers exploit with fabricated identities and human signals mimicked by AI.

The evidence also suggests that fraud is shifting from the documentary plane to the representation plane. It is no longer enough to fake a document. Attackers clone voices, generate faces, fabricate work histories, simulate family emergencies, produce extortion videos, or manipulate passport-style photos. This directly affects banks, fintechs, digital merchants, and lending platforms, because traditional control tends to validate separate pieces of evidence, not the full genealogy of the presented subject. The result is an operational risk, but also a compliance risk, a reputational risk, and losses from first-party fraud or third-party induced fraud.

Bolivia

Bolivia shows a highly visible layer of public awareness and alerts. El Deber shared an Instagram video linking artificial intelligence, deepfakes, and phishing to bank calls using cloned voices. Bolivisión, in turn, published a segment with specialists explaining how to prevent extortion through AI-generated videos and warning about the risks of identity theft. Bolivia's Central Bank warned about emails and social media posts designed to manipulate victims psychologically by making them believe their accounts are at risk.

At the institutional level, the Ministry of Economy and Public Finance denied a supposed advertisement for "ASFI Renta" and direct transfers to banks, while ASFI warned about fake investment offers with fabricated profit screenshots, websites without legal information, and payments only in cryptocurrencies or unregulated wallets. Banco Nacional de Bolivia reinforced on Facebook and Instagram that messages asking for usernames, passwords, or personal data are digital scams, and Banco Bisa asked users to pause and verify before answering calls or sharing credentials. Banco Unión highlighted the growth of digital payments as part of Bolivia's economy, which adds context, the more digitized the environment becomes, the greater the exposure to remote fraud if controls do not grow at the same pace.

The Bolivian case does not, by itself, prove a measurable wave of synthetic identity on the scale of Brazil or Colombia, but it does show an environment where phishing, smishing, fake investments, digital extortion, voice cloning, and profile impersonation are already part of the public and regulatory conversation. The presence of a reported alleged scam involving BancoSol loans, cited by ADICH Radio and marked as an uncertain source, fits that broader picture, although it does not support additional technical attribution.

Colombia

Colombia is the country with the most advanced regulatory movement in the available material. According to the legal analysis by Abogados.com.ar, in July 2025 Article 296 of the Criminal Code was reformed to penalize identity impersonation when carried out with artificial intelligence, and concepts such as deepfake, image, and digital identity were explicitly recognized. The same analysis says that, compared with Brazil, Argentina, Mexico, and Chile, Colombia has already linked AI directly to criminal protection of identity.

On the operational side, Blu Radio reported cases in which AI is used to impersonate relatives or acquaintances with fake audio or video to request money. El Tiempo described frauds in which criminals duplicate the voices of known people or employees and present them as part of the most common digital scams. The combination of criminal law, public circulation of cases, and citizen training suggests that the problem is already visible enough to have entered the legal and media agenda, although the corpus does not provide local prevalence statistics.

Brazil

Brazil is the clearest case of quantitative acceleration. Exame, citing Federal Police data, reported that deepfake use grew 830% between 2024 and 2025. The same report said AI tools were present in 42.5% of financial frauds recorded during that period. The story is not limited to volume. Exame described two concrete patterns, voice cloning from just a few seconds of audio pulled from social media or WhatsApp to simulate emergencies and obtain immediate transfers, and the use of face and voice deepfakes of celebrities in social media ads to promote fraudulent investments, products, or raffles, often tied to Pix.

The Unico information reinforces the defensive angle. The Brazil-based company increased its identity verification transaction volume by 84% in the first quarter of 2026 compared with the same period a year earlier. Its expansion outside Brazil is happening just as identity verification becomes a critical layer for banks, fintechs, and merchants exposed to AI-driven fraud. Its platform combines facial biometrics, liveness, and identity authentication, with offerings such as Unico IDCloud One and Unico IDPay. The company data confirms that the defense market is growing alongside the threat.

Mexico

Mexico appears less often in quantitative terms, but it does show operational and educational pressure. Asociación La Nacional warned that criminals are already building full identities by mixing real information with artificial data and urged the Congress of the Union to focus on the impact of synthetic identity fraud. An educational social media post said fraud in the country not only grew, but became more sophisticated, incorporating synthetic identities, deepfakes, and altered documents. That angle matches the regional trend away from simple scams and toward AI-supported schemes aimed at credit and payments.

On the corporate side, fintechexpert.mx said identity verification is becoming a critical layer for banks, fintechs, digital merchants, and platforms exposed to AI-generated fraud. In addition, the note on Unico suggests that part of regional demand is shifting toward biometrics, liveness, and enhanced identity validation tools. Mexico, according to the material, does not lead the regulatory narrative, but it is clearly a market where the discussion has moved beyond theory.

United States

The corpus provides only an economic and scale reference point. FRPA, citing Javelin Strategy & Research, reports that U.S. consumers lost $27.3 billion to traditional identity fraud in 2025. Although the figure is not specific to synthetic identity or Latin America, it helps frame the size of the identity fraud economy in which this modality operates. In the same source ecosystem, Fintech Global adds that the FBI reported $893 million in losses tied to AI-related scams during 2025, a figure the bureau itself considers conservative.

Brazil, Colombia, and Mexico, the most visible triad

Taken together, the material shows Brazil providing the evidence of growth and volume, Colombia the most advanced legal response, and Mexico the signal of problem sophistication and pressure on the financial ecosystem. Bolivia, by contrast, shows a very active public and banking alert layer. The result is a regional map where AI-driven synthetic identity is no longer a homogeneous or marginal threat. In some markets volume dominates, in others regulation, and in others antifraud education. But the underlying pattern is the same, the replacement of verifiable identity with fabricated identity.

The countries with no additional verified facts in the material are Argentina, Chile, Paraguay, and Peru.

Technical Indicators

No classic IOCs such as hashes, domains, IPs, or specific accounts were published in the consolidated material. There are, however, operational technical indicators that are useful for detection and prioritization, even if they do not amount to traditional threat intelligence.

Analysis for Security Teams

The first operational implication is that identity control can no longer be treated as a one-time event. The material shows a shift from initial validation toward continuous and contextual verification. A system that only checks whether the document and the face match risks accepting a fabricated identity that is internally consistent. That is why the defenses most often cited in the corpus are not limited to OCR or facial matching, but include stronger biometrics, active and passive liveness detection, real-time analytics, and cross-checking against broader sources.

The second implication is that teams need to treat onboarding as a multi-channel attack surface. DuckDuckGoose.ai describes the use of AI-generated faces, deepfake video, and virtual cameras. Veriff adds abuse of legacy APIs. That means reviewing not only the front-end layer, but also the integration between the verification provider, risk engine, video orchestration, and manual fallback processes. An attacker does not need to break the entire system, only to find the least resistant point between layers.

The third implication is that identity maturation matters as much as creation. Fitzpatrick describes a sequence that begins with stolen data and ends with low-risk accounts and high-value products. If an organization only monitors account opening, it can miss the window where the profile looks legitimate but has not yet monetized. Risk models need to account for behavioral signals, changes in transaction patterns, repeated devices, abnormal maturation times, and consistency between declared attributes and actual activity.

The fourth implication is managing the support and recovery channel. The Indian Ministry of Home Affairs alert, via I4C, shows that attackers do not only target onboarding, they also use synthetic identities and deepfakes to evade account recovery, facial authentication, and video-KYC. That means review of credential reset procedures, phone number change validation, access restoration, and call center handling. Cloned voices and fake videos are convincing enough to affect human operators if procedures do not include additional brakes.

The fifth implication is internal training. The regional material from Bolivia, Colombia, and Brazil suggests that many frauds now take the form of calls, messages, or videos that appear familiar. Antifraud, risk, and customer service teams should share signals, escalation scripts, and rejection criteria. A call with a cloned voice, a video of a supposed relative, a passport photo requested over chat, or a new account trying to move too quickly toward high-value products should not be treated as isolated incidents.

In terms of prioritization, the material suggests focusing on three areas. First, harden remote onboarding with robust liveness detection and non-reusable verification mechanisms. Second, strengthen post-onboarding monitoring, because synthetic identity often matures before it monetizes. Third, audit API integrations and fallback flows, since Veriff warns that attackers are exploiting precisely those legacy and point-in-time junctions. Added to that is the need to correlate voice fraud, phishing, extortion, and document impersonation events as part of the same ecosystem, not as separate incidents.

Material Limitations

The corpus is strong on trend, technique, and sector examples, but it has clear limits. It does not include classic verifiable IOCs, nor campaigns with domains, hashes, IP addresses, malware names, or attributable infrastructure. It also does not provide a country-by-country statistical breakdown for Latin America that would allow a rigorous comparison of synthetic identity incidence across markets, beyond the cases of Brazil, Colombia, Bolivia, and indirect references to Mexico.

Several sources appear as attributed by the material itself rather than verified first-hand, including Sputnik Mundo on X, FRPA's summary of Mitek and Datos Insights, AdaptiveSecurity in a trend analysis, Unico on LinkedIn regarding the limits of traditional KYC, some Instagram content, and context references on LinkedIn. These pieces are useful for technical and narrative reading, but should be treated with the appropriate caution.

There are also no longitudinal series for Latin America that would allow quarterly or annual evolution to be measured with the same precision that Exame documents for Brazil. The consolidated research does allow one to say that the problem has already reached critical regional scale, that 48.3% is the highest global value reported in the cited report, and that remote identity controls face a structural gap against fabricated identities. What it does not yet allow is a uniform curve of spread by country, sector, or financial product type.

Finally, the material does not provide forensic evidence of a specific campaign against a named entity in Latin America. For that reason, this research should be read as a technical analysis of trend, TTPs, and operational exposure, not as attribution of a single operation.