Latin America bank fraud scales up

Most common fraud tactics

Infobae reported that the most common tactics used to drain bank accounts in Latin America include phishing with malicious links, impersonation of banks by phone calls and messages, fake apps designed to capture credentials, and malware paired with remote access tools to take over victims' devices.

The same report warns that a single click on a malicious link or file can open the door to credential theft, malware installation and the capture of two-factor authentication codes, giving attackers access to bank accounts.

Social engineering, now at regional scale

In Chile, banks issued an alert over the rise in vishing, a scheme in which cybercriminals call users while posing as bank executives, technical support staff or police officers to steal passwords and transfer credentials. El Mostrador also notes that this fraud becomes more effective when attackers use personal data previously leaked online to build trust.

The security guidance cited by that outlet says banks will never ask by phone for secret keys, transfer passwords, coordinate card codes or approval of transactions in the app while the customer is still on the call. Any such request should be treated as a fraud indicator. It also notes that, under Chile's fraud law, financial institutions must maintain 24/7 blocking channels for cards and digital access, accept formal claims for loss, theft or fraud, and comply with the legal deadlines for responding and, when applicable, returning funds.

CronUp, meanwhile, warned about a mass smishing campaign in Chile that spreads through SMS messages with links to fraudulent sites impersonating public agencies and financial institutions. The operation keeps adding new domains and seeks personal and financial data through social engineering.

Brazil and the move toward criminal structures

Evertec Trends says that in Brazil, financial fraud is no longer carried out mainly by isolated individuals, but by highly structured criminal organizations with divided roles for social engineering specialists, malware developers, money launderers, mule account operators and makers of forged documents.

The analysis also says that open banking and the consent-based sharing of financial data are being exploited by malicious actors who fake consent, hijack authentication sessions or use social engineering to convince customers to authorize unauthorized access. According to the report, the risk has shifted away from the technology itself and toward manipulation of human behavior.

The same study documents identity fraud schemes that include synthetic fraud, which combines real and fictional data, and the use of AI-manipulated selfies, or deepfakes, to bypass facial biometrics in digital onboarding and identity verification at banks and fintechs.

Argentina, Mexico and other warning signs

A Mercado report based on findings from Sumsub and BioCatch says that in Latin America, advanced fraud using AI-generated identities grew 180%, while social engineering scams tied to digital banking fraud rose 155%.

In Argentina, even with a 20% drop in the overall volume of incidents, scams became more dangerous: social engineering fraud rose 183% and the use of identity deepfakes increased 66%, putting pressure on digital identity controls at local banks and fintechs. Another warning circulated by Argentine media, with recommendations from Argentina.gob.ar, describes a new method in which home banking is blocked and then a call is made pretending to be from the bank. The official advice is to hang up and contact the institution through official channels, without giving away usernames, passwords, PINs, tokens or text-message codes during the call.

In Mexico, NoticiasNeo reported a 202% rise in phishing and laid out seven digital items that should be preserved for an effective complaint, including the original email or message with full headers, the URL of the fraudulent site, screenshots, call logs involving social engineering and transfer receipts.

More cases across the region

Vanguardia recorded 866 recent cyberfraud complaints in Bucaramanga, Colombia, and recommended protecting credentials with strong passwords and multifactor authentication, as well as distrusting urgent messages and checking senders, domains and URLs before clicking or sharing information.

Elonce described how digital scams have evolved into complex schemes in which criminal groups use artificial intelligence, social engineering, social media campaigns and financial structures to make the money harder to trace. In Venezuela, IP Media Group, citing ESET, warned about fake fundraising drives and donation pages that even use AI to generate news or videos about supposed victims, with the aim of exploiting emotional urgency and obtaining financial data or fraudulent donations.

ConAcento in Mexico also quoted a cybersecurity specialist who described these scams as operations run by criminal organizations with defined structures, where different members recruit victims, develop the social engineering, use AI to impersonate identities and then launder the money.

BBVA Mexico, in its digital fraud prevention guide, stresses that criminals exploit urgency to get users to hand over information voluntarily. The bank says it will never request keys by phone calls, text messages or email, advises users to end the communication, verify through official channels and use functions such as "Turn off card" along with an immediate password change after an incident.