Traditional Banking and Insurers, September 2026

Active Threats and Campaigns

Fraud and Phishing

Fraud was by far the dominant threat in September. The 37 verified incidents tied to fraud or phishing point to a broad and varied attack surface, ranging from bank impersonation scams and banking malware to fake lenders, deepfake attacks, and benefits fraud. The spread of cases suggests there was no single regional campaign, but several abuse families that share social engineering, identity manipulation, and credential theft techniques.

In Argentina, Bolivia, and Paraguay, fraud often centered on brand impersonation and deceptive offers of loans or services. In Mexico, the main vector was mobile devices, fake apps, and malware aimed at unauthorized transactions. In Brazil, fraud became more technical and automated, with an emphasis on facial biometrics, virtual cameras, and synthetic content. In Peru and Colombia, fraud also showed up in the way regulators are reorganizing their reporting rules and identity validation requirements.

One common thread ran through almost all of the month’s cases. The attacker tries to close the gap between the legitimate user and control of the process. Stealing a password is no longer enough. The attacker has to intercept the second factor, spoof a biometric check, trick the help desk, force an immediate transfer, or insert a fake document into customer onboarding. That shift makes several controls designed for less adaptive threats obsolete.

Ransomware and Extortion

No cases of ransomware or extortion were recorded as the primary focus in September’s material. There were also no verifiable descriptions of asset encryption, simple extortion through exfiltration, or isolated mentions in leak sites that would allow the impact to be classified precisely. The absence of this category in the corpus should not be read as the absence of ransomware in the region, but as the absence of confirmed cases in the material reviewed.

That absence matters because it changes the priority picture. In months with ransomware, the discussion usually centers on downtime, recovery, and negotiation. In September, the focus was instead on fraud prevention, identity authentication, and the ability to report operational incidents in time. For banking and insurance, that means the dominant risk was not paralysis, but the fraudulent takeover of accounts, sessions, and decisions.

APT and Targeted Intrusion

September’s material did not support an APT or targeted intrusion campaign with enough precision for this vertical. There were references to attacks against payment systems and to organizations in the financial, retail, and e-commerce sectors in Brazil, but the available source did not confirm a traditional bank or an insurer as a separate affected entity. For that reason, this report does not elevate that material to a consolidated APT campaign.

The cautious reading is that the threat environment does include actors capable of using AI and automation to speed up intrusions, but this month’s material was not enough to isolate a classic espionage or persistence campaign aimed specifically at banking or insurance. The dominant pressure remains fraud, not prolonged stealth intrusion.

Critical Vulnerabilities

No critical CVEs were recorded in the September 2026 material reviewed. That does not mean critical vulnerabilities were absent from the region, only that they were not mentioned in the verified sources for the month.

Regulation and compliance

The month’s regulatory agenda was intense, though less crowded than August. In Argentina, Communication A 8471 from the BCRA formalized fraud risk management for financial institutions and payment providers, with requirements covering structures, policies, the designation of responsible officers, and risk appetite definitions. The rule’s significance is that it makes fraud an explicit component of operational risk and links it to products, services, and digital channels.

The same country also saw another key move, because the BCRA announced that starting in September 2026 it would make public information available to administrators of instant transfers to strengthen fraud analysis and monitoring. That points to a better reading of risk profiles and a more intensive use of data for prevention. For compliance teams, the message is that prevention is not limited to post-event monitoring, but extends into customer onboarding and periodic review logic.

In Bolivia, the government approved Supreme Decree 5693, which relaxes rules applicable to financial intermediation entities to protect their solvency, and it also reported on a decree that assigned registration, reporting, supervision, control, and follow-up duties for certain certificates to ASFI. Added to that is the commitment, under a program backed by the IMF, to develop a regulatory and supervisory framework for virtual assets to reduce the risk of illicit capital outflows and protect financial resilience.

In Colombia, the SIC opened a public consultation on identity validation and personal data processing, while the Superintendence of Finance reminded the market that its controlled experimentation space, LaArenera, is used to identify risks and generate evidence to strengthen supervision and regulation. The thread is clear, the regulator wants greater capacity to validate identity technologies and to understand how financial innovation affects risk.

In Peru, the SBS proposed a single procedure for reporting operational incidents, with initial, interim, and final reports. The consultation matters for banks, insurers, and pension funds because it unifies criteria that were previously split by incident type. For compliance and crisis management teams, that means reorganizing internal manuals, escalation flows, and responsibilities across operations, technology, risk, and legal.

In Paraguay, the regulatory debate was shaped by the Senate’s request for information from the BCP on financial entities, cybersecurity controls, and alleged cyberfraud. Although it is not a new rule, it is a compliance event in the broader sense because it increases public scrutiny of the supervisor and forces the system to explain its response capacity. At the same time, the central bank issued digital security recommendations for the use of electronic channels.

Countries and most affected subsegments

Brazil

Brazil had the highest concentration of events tied to fraud, biometrics, deepfakes, and police actions. The most affected subsegment was digital banking and onboarding, followed by payments and benefit schemes. Insurance also emerged through cyber insurance and analysis of risks linked to advanced fraud. The mix of regulatory, operational, and law enforcement coverage makes Brazil the region’s main laboratory for the month.

Brazil’s events show a market where identity is at the center of the conflict. Deepfakes, virtual cameras, voice cloning, and direct injection techniques are all aimed at breaking trust in facial biometrics as the only barrier. At the same time, the state response is taking shape through tighter controls, more traceability, and coordinated investigations. That two-sided dynamic gives the country a central place on September’s map.

Argentina

Argentina stood out for the clarity of its rules and for the treatment of fraud as an operational risk. Traditional banking and payment providers were brought under an implementation framework that begins with Communication A 8471 and is tied to public information sharing by the BCRA to monitor instant transfers. The most affected subsegment is payments and transfers, where the speed of transactions and the level of digitization increase exposure.

The country did not record a long list of incidents, but it did show a concrete regulatory response that is likely to shape the wider market. The fact that risk analysis extends to products, services, processes, and digital channels forces banks and PSPs to review control models, not just isolated cases. For the sector, Argentina ends the month as a case of regulatory maturity.

Mexico

Mexico showed a heavy fraud burden linked to mobile devices, fake apps, and social engineering attacks. CONDUSEF and the ABM urged caution against malware capable of capturing credentials and taking control of devices, and the number of complaints over unrecognized charges or transfers remained high. The most sensitive subsegment is consumer banking and its mobile channel.

Mexico matters not because of a single incident, but because the problem persists and the attack surface is varied. The coverage points to an ecosystem where fraud relies on malware installation, app impersonation, and abuse of user trust. That makes preventive education and device monitoring central to control.

Colombia

Colombia stood out for the interaction between digital identity regulation and insurance-sector concerns. The SIC opened a public consultation affecting financial and credit entities, while the Financial Superintendency focused on cybersecurity, fraud, and third parties in insurance. The affected subsegment is twofold, on one side identity validation in financial services, on the other risk management in insurers.

The key issue in Colombia is that the debate is not only about attacks, but also about how identity is verified and what standards should govern that verification. That could affect onboarding, account recovery, remote signing, and access to policies or credit products. The regulatory discussion is, in itself, part of the risk surface.

Paraguay

Paraguay saw a month of institutional pressure on the financial system, with requests for reports on alleged cyber fraud and high-level meetings between authorities and banks. The most exposed subsegment is traditional banking, especially entities under scrutiny for controls and response. Although there was no confirmed major technical incident, the political and reputational burden was high.

That was compounded by preventive warnings from the BCP about requests for data and urgent calls tied to account blocks. The message matches the regional trend, fraud does not always arrive as a visible intrusion, but as an abuse of trust and urgency. Paraguay therefore appears as a country where the governance of the system came under review.

Peru

Peru combined high criminal statistics with a regulatory proposal that directly affects banks, insurers, and pension systems. The most relevant subsegment is operational incident reporting, because the SBS wants to unify and speed up notification of significant events. In addition, complaints of computer fraud and identity theft continue to show a sustained pattern of abuse against users and entities.

The proposed reform matters because it aligns the supervisor’s response with the operational reality of incidents that can no longer be classified simply. For insurers and banks, the change requires early detection, documentation, and escalation capabilities. Peru did not close the month with a single major incident, but it did with a more demanding regulatory architecture.

Trends and signals to watch

The first signal to watch is the drop in total volume from August, from 125 to 83 incidents, without that meaning the risk has eased. Fraud remained the main threat, with 37 documented incidents, only seven fewer than the previous month. In other words, the number of reports fell, but the center of gravity of the risk for banking and insurance did not change.

The second signal is the sharp decline in regulatory moves, from 25 in August to 7 in September. That decline does not reflect a lack of interest, but a shift from drafting to implementation and public consultation. In Argentina and Peru in particular, new rules or rules under consultation suggest that October and November could show more internal adaptation work than policy announcements.

The third signal is the advance of identity-based threats. Deepfakes, facial biometrics, virtual cameras, voice cloning and masked calls appear across different countries in different terms, but with the same logic, breaking authentication controls. What matters is not only that these techniques exist, but that they are already entering banks’ perimeter and, by extension, the processes insurers use to verify customers and claims.

The fourth signal is that several regulators are already treating fraud as an operational risk, not as a one-off abuse. That changes expectations for reporting, traceability, governance and timelines. The contrast with August is also useful: the previous month saw more incidents and more regulation, but September sharpened the narrative around fraud as the main vector and the need to standardize incident reporting.

Security team recommendations

Banks and insurers should treat September as a month for tightening identity controls, not as a routine awareness period. The immediate priority is to review the full authentication journey, from customer onboarding to recurring transactions, because the fraud observed is not limited to initial access. It moves through transfers, biometric checks, and credential recovery.

Risk signals from the device and the channel also need to be strengthened. Cases in Mexico show that a compromised mobile phone remains a central entry point. That means integrating mobile endpoint telemetry, overlay detection, app integrity checks, behavioral verification, and dynamic friction for high-risk transactions. If the channel cannot tell a legitimate user from a manipulated environment, losses can occur even when the password is correct.

Multimodal authentication standards also need to be raised. Evidence from Brazil indicates that facial biometrics alone are no longer enough when deepfakes, direct injection, or reused validations are in play. Teams should combine face recognition with contextual signals, transaction risk, cross-checks, and anti-abuse controls on device changes, remote onboarding, and unusual activity. The recommendation is not to abandon biometrics, but to stop treating them as sufficient proof.

Fraud and compliance teams should also review their notification and escalation timelines. Peru’s SBS and Argentina’s BCRA are pushing for faster, more structured reporting, which in practice requires ready-to-use playbooks, clear owners, and evidence collected from the start of the event. If an organization takes too long to classify an incident, it will also take too long to contain it and report it to the regulator.

For the insurance business, the lesson is similar, but with a different emphasis. Third-party risk, data quality, and operational continuity need closer review, because those were precisely the risks flagged by Colombia’s Superintendencia Financiera. Insurers that depend on analytics models, bank integrations, or digital document workflows need to test what happens when identity fails, when a provider goes down, or when fraud undermines the validity of a record.

Finally, threat intelligence should focus on fraud, not just malware. The month showed a convergence of social engineering, impersonation, automation, and trust manipulation. Security teams should monitor fake financial campaigns, brand abuse, spoofed calls, account opening attempts, and fraud paths tied to benefits, payments, and instant transfers.

Frequently Asked Questions

What regulatory changes crossed banking and insurance this month?

Argentina, Peru, and Colombia accounted for the most relevant changes for both sectors. Argentina's BCRA formalized anti-fraud measures for financial entities and payment providers, Peru's SBS proposed a single report for operational incidents across banking, insurance, and pensions, and Colombia's SIC opened a consultation on identity validation and personal data.

Which fraud technique was most exposed by facial biometrics?

Brazil showed that the main problem is no longer only fake photos or videos, but direct injection, virtual cameras, and reused validations. That overlaps with the facial biometrics discussed by InfoMoney and with the imposter scheme described by Agencia Brasil, where the goal is to bypass the entire identity process.

How does incident reporting change for financial institutions and insurers?

In Peru, the SBS proposed replacing separate reports with a single operational incident report, with initial deadlines of up to two hours for certain companies and up to five hours for banks and other entities. That brings continuity, cybersecurity, and operations into one reporting flow.

What is the link between digital fraud and banking supervision in Paraguay?

Paraguay showed that fraud did not remain only a technical issue. The Senate requested reports from the BCP on controls, sanctions, and alleged cyberfraud, while the central bank responded with recommendations for operating through digital channels. The debate combined reputation, controls, and the supervisor's institutional capacity.

What should an insurer's CISO watch besides banking fraud?

They should watch data quality, third-party dependence, and operational continuity. That combination appears in the Superintendencia Financiera de Colombia's assessment for the insurance sector and connects with identity risk, onboarding, and the use of analytical models. This is not only about attacks, but also about failures that undermine trust in information.

Material limitations

This report was built exclusively from the verified facts provided for September 2026 and from the sources listed as citable. No facts from other months were used for the period count, although the explicit comparison with the previous month was incorporated according to the indicators already provided.

The time window for the indicators is the one stated in the report base, 83 facts dated in September 2026. When accumulated figures from January to July or from other periods are cited, they are included only as descriptive context, not as the monthly volume. Figures from other windows were not added to the September period.

A zero indicator, particularly for critical CVEs, means none were recorded in the material analyzed, not that no critical vulnerabilities exploited in the region exist. The same applies to the ransomware and extortion line, which had no typifiable cases in this month’s corpus.

Aggregated telemetry for attempts or blocks was also left out of the analysis base because no methodologically consolidated figures were provided to turn them into incidents. Consumer social networks and sponsored posts were excluded as well, because they do not appear among the sources authorized for citation.