Mexico City criminalizes phishing
Mexico City’s penal code now treats phishing as a crime, with penalties of 3 to 6 years in prison and fines of 200 to 600 UMAs.
Mexico City’s Congress approved a reform to the local penal code that makes phishing a crime and sets penalties of 3 to 6 years in prison, plus fines of 200 to 600 UMAs. The measure was published in the Official Gazette on July 22, 2026, and took effect the next day.
Mexico City’s Congress approved a reform to the local penal code that makes phishing a crime. The law defines phishing as digital deception used to obtain personal, financial or authentication data. The penalty is 3 to 6 years in prison and a fine of 200 to 600 UMAs.
When the reform took effect
The amendment was published in Mexico City’s Official Gazette on July 22, 2026, and took effect the following day. According to the cited publications, the measure is already in force in the country’s capital.
Aggravating factors
The reform also says penalties will increase by up to half when the victim is a person with a disability, an older adult or a minor. That provision expands the criminal response to cases in which the digital attack targets groups the law considers vulnerable.
Infobae Mexico reported that the capital’s Congress approved the reform to the local penal code, while La Silla Rota noted the official publication and immediate entry into force. Milenio also reported that phishing is now a crime in Mexico City and detailed the sanction framework set by the reform.
Sources
- CDMX castiga las estafas digitales con hasta 6 años de cárcelinfobae.com· Infobae México
- Phishing es delito en CDMX: habrán penas de hasta 6 años de cárcellasillarota.com· La Silla Rota
- Phishing ya es delito: así se castigará en la CdMxamp.milenio.com· Milenio
