Peru’s SBS warns of digital fraud

Peru’s Superintendency of Banking, Insurance and AFPs warned in July 2026 about a rise in complaints tied to digital fraud and identity theft. According to the regulator, criminals are obtaining personal and financial data through phishing and phone calls, then carrying out unauthorized banking transactions without customers’ authorization.

What the SBS described

The SBS warning focused on identity theft cases involving financial products. According to the agency, the scheme starts with the capture of sensitive data and ends with unauthorized banking operations. The source places these incidents within the broader increase in complaints reported by the regulator in July 2026.

Other signals in the financial system

Among the available sources is also an SBS alert on the fraudulent use of biometric data and OTP codes, along with a set of best practices for managing cybersecurity risk in the financial system. The material also includes an SBS note on the responsibility of financial institutions to use strong customer authentication.

In parallel, Peru’s Central Reserve Bank published recommendations on digital payments, while ASBANC issued an alert on smishing and vishing aimed at digital banking customers. The PCM’s National Digital Security Center included the financial and fintech sectors in its January 2024 bulletin.

Investigations and sector responses

The National Police of Peru reported dismantling a group dedicated to cloning mobile banking apps. There is also a Public Ministry statement on investigations into digital banking fraud and identity theft.

From the private sector, Yape issued a statement on attempts at fraud using fake accounts and stolen identities, while Niubiz said it strengthened its anti-fraud systems after an increase in suspicious transactions. OSIPTEL, meanwhile, warned about SIM swapping fraud and the risks it poses to mobile banking.

The research material also includes a sanction imposed by the National Authority for Personal Data Protection on a financial institution for failures linked to personal data protection.