Colombia orders debt relief in ID theft cases

Update August 23, 2026: Law 2573 of 2026 was issued on May 19 and is already entering force in stages, with the general regime set to begin around November 19, 2026. Official data were also added on the scope of fraud in Colombia, with 62,299 reports of cybercrime in 2025 and 764 so far in 2026 at the time of the police statement.

Law 2573 of 2026 in Colombia requires the immediate suspension of any collection tied to a credit or financial obligation when a person claims to be a victim of identity fraud or identity theft, as long as the entity already knows about the complaint.

What changed with Law 2573 of 2026?

The law, issued on May 19, 2026, expands protection against negative reporting to information operators and against collection on obligations obtained through identity theft in Colombia. According to the Bogotá mayor’s office, the general regime takes effect six months after enactment, while certain paragraphs of Article 5 took effect on that same date.

How does the burden of proof work?

The law introduces the principle of dynamic burden of proof in this context. That means the financial institution, telecom operator, or merchant must show what methods it used to verify identity before approving the credit, purchase, or service when identity theft is alleged.

Banks and other credit providers must also give the presumed victim copies of all documents used to approve the transaction that was allegedly obtained through the impersonation.

What happens if the courts confirm the identity theft?

If the judicial authority concludes that identity theft occurred in a credit or obligation, the affected person is exempt from paying the debt. They also do not have to pay interest or any other related charges.

In that same scenario, the person must be removed from negative reports tied to that obligation in Colombia.

A combined reading of Laws 2502 of 2025 and 2573 of 2026 highlights that, after a complaint is filed within 20 business days and collections are temporarily suspended, if identity theft is determined, the victim is released from obligations fraudulently taken out in their name.

What channels are available to file a complaint?

Colombia’s Ministry of Justice and Law says financial consumers can file complaints against banks, insurers, and financing companies with the Superintendence of Finance of Colombia, financial consumer advocates, local ombuds offices, the Public Defender’s Office, and consumer associations. According to the ministry, those channels can be used to impose sanctions or to settle disputes over financial services.

What do the official figures say about the problem?

The National Police officially reported that 62,299 cybercrime complaints were filed in 2025, and that these offenses accounted for 88% of the digital crime phenomenon. So far in 2026, 764 cybercrime complaints had been recorded at the time of the statement.

The Superintendence of Industry and Commerce said that between 2022 and May 2026 it received 13,983 identity theft complaints through the SIC Facilita platform, 11,365 of them related to telecommunications. The agency also said that since 2023, fines in these cases have exceeded 2.39 billion pesos, mainly against operators that failed to apply adequate controls.

Debt collection in Colombia for identity theft

If a person claims they were a victim of identity theft, Law 2573 of 2026 orders the immediate suspension of any collection related to that debt in Colombia, provided the entity already knows about the complaint. If the courts confirm the theft, the affected person is exempt from paying the debt and does not have to cover interest or any other associated charges.

The law also requires entities to prove what mechanisms they used to verify identity before approving the credit, purchase, or service. In addition, they must provide copies of the documents used to authorize the transaction and, if the fraud is confirmed, delete the negative reports linked to that obligation.