Deepfakes and phishing pressure LATAM firms

Deepfake videos that imitate the faces and voices of well-known people are already raising concerns in Colombia, where they are being used in false posts aimed at generating financial gain. In Ecuador, an academic study argues that the Organic Comprehensive Criminal Code does not explicitly regulate the use of AI in fraud cases, and proposes amending Article 186 to treat that use as an aggravating factor.

How are these techniques being used?

Available material points to two main vectors, fake video impersonation and advanced phishing backed by AI. According to analysis published by Ikusi, these techniques can clone the voice, face and writing style of executives, suppliers or clients to try to authorize fraudulent payments or obtain sensitive information.

In Colombia, El País Cali reported concern over fake posts using deepfakes that replicate the traits of known people to mislead victims for financial gain. In Peru, The Latin Times said deepfakes are already emerging as a risk to critical business processes, including payment approvals, executive communications and vendor management.

What does the regulatory debate in Ecuador propose?

Research from the Pontifical Catholic University of Ecuador concludes that the COIP lacks an explicit rule for AI used in fraud and proposes reforming Article 186. The proposal would add the use of artificial intelligence as an aggravating factor, but it would require proof of direct intent and a qualified forensic computer expert report.

That approach is intended to provide a more precise criminal basis for cases in which automation or synthetic generation is part of the fraud. The academic work also links the issue to the principle of legal certainty, in a context where offensive use of these tools is already appearing in several countries across the region.

What does the Mexican case show?

Infobae Mexico reported, based on reports circulated about the case, that the cybercriminal group Chronus allegedly used automated tools and AI-backed capabilities to inspect infrastructure tied to Mexican institutions, identify vulnerable subdomains and exploit weak points. That point remains framed as an allegation drawn from reports that have not been officially confirmed.

The regional picture emerging from these sources is clear. Deepfakes and generative phishing are no longer limited to mass deception campaigns, and they are also being adapted to internal company processes, suppliers and authorities. The debate in Ecuador, meanwhile, aims to close a specific legal gap around that kind of fraud.