Traditional Banking and Insurers, Oct 2026

Monthly reference modules

These modules are filled automatically with verified dated facts within the period. Each one states its basis and counting criterion, so the figures reconcile across modules. They are the recurring month-to-month readout; the analysis that follows develops the cases without repeating this summary.

Indicator window: 59 dated facts in October 2026. Facts from earlier months are used only as comparative context in the analysis, never as volume for this period.

Monthly executive summary

October was defined by digital fraud targeting traditional banks and insurers across Latin America, with 26 of 57 verified incidents during the period. The month’s picture combined impersonation campaigns, fake loans, credential manipulation, and regulatory alerts in Argentina, Bolivia, Chile, Colombia, Mexico, Paraguay, and Uruguay, along with a complete absence of classifiable ransomware in the material reviewed.

The intensity was not uniform, but it was sustained. There were 6 unclassified incidents, 26 documented fraud or phishing cases, and 2 clearly identified regulatory moves, creating a high regional risk reading because of the volume of deception, the geographic spread, and the direct exposure of financial institutions and insurers to social engineering techniques. Most of the incidents did not describe intrusions into critical infrastructure, but rather exploitation of the human channel and the onboarding, payment, or authentication process.

Argentina concentrated a significant mix of official alerts and regulatory debate. The BCRA stepped up its anti-money laundering activity and its analysis of new threats together with the UIF, while various media outlets reflected the impact of Communication A 8471, aimed at organizing fraud reports, internal responsibilities, and traceability of amounts recognized to the customer. At the same time, reports described phone-based fraud, scams targeting retirees, and exposure to tactics that exploit trust in banks, digital wallets, and online channels.

Chile had one of the month’s most active agendas, not because of a larger infrastructure breach, but because of the rollout of stronger authentication measures, CMF complaints against entities and sites offering loans or charging upfront fees, and warnings about the real sufficiency of authentication factors against phishing. The regulatory debate was shaped by a concrete risk, credential theft and the diversion of flows before the user realizes the scheme.

Bolivia, Uruguay, Paraguay, Mexico, and Colombia added signals that were different in form but consistent with the same trend. In Bolivia, police and Banco Unión described fake links, fraudulent banking apps, AI-based voice cloning, and a high daily volume of attempts. In Uruguay, the BCU tightened two-factor authentication and adjusted controls over electronic transactions. In Paraguay and Mexico, loan scams and institutional impersonation dominated, while Colombia saw large-scale phishing campaigns and fake domains mimicking financial brands.

Regional outlook for the month

October’s regional risk sits at a high level because the month combined a large number of verified incidents, geographic spread, and a dominant threat that directly affects money flows, customer identity, and trust in financial brands. There was no confirmed escalation in ransomware or encrypted extortion, but digital fraud and impersonation of entities continued to operate, with potential impact on accounts, loans, cards, and customer onboarding processes.

Country distribution shows a recurring pattern: attackers use low-cost, high-reach channels such as WhatsApp, Telegram, email, phone calls, cloned websites, and social media ads. In several cases, the goal was not only to steal credentials, but to force advance payments, induce deposits for withdrawals that did not exist, or install malware that enables unauthorized transfers. That pattern links retail banking, wallets, payment gateways, and, in some cases, insurers and nonbank financial services.

The regulatory front did not stand still. Uruguay and Chile strengthened authentication and reporting requirements, while Argentina moved forward with reviewing suspicious transaction reports and coordinating with the UIF. Colombia appeared with obligations to notify significant incidents, and the rest of the region kept approaching the same problem from different angles, how to require more controls without breaking usability or leaving gaps in the customer experience.

The broader signal this month is that fraud is becoming industrialized faster than the ecosystem’s response can be standardized. The evidence from the period does not show a major ransomware operation against banks or insurers, but it does show a mature scam environment that combines social engineering, automation, generative AI, brand clones, and payment or verification mechanisms designed to move money before an analyst can intervene.

Period indicators

Relevant Incidents

Communication A 8471 and Argentina's anti-fraud shift

The most important signal in Argentina was not a single incident, but the consolidation of a regulatory and operational response around banking fraud. The BCRA said it held meetings with financial institutions on oversight and the quality of Suspicious Transaction Reports, along with working groups with the UIF and other system actors to assess new threats and strengthen preventive capabilities against illicit financial flows. That puts fraud and money laundering under the same supervisory lens, with an emphasis on traceability and early response.

Within that framework, VU said Communication A 8471 will require channels for reporting fraud and a single reporting database with data such as amounts recognized to the customer, applying from December 1, 2026 for financial institutions and gradually through September 2027 for payment account providers. That architecture suggests the regulator wants to reduce information fragmentation and improve its ability to spot patterns.

Palermonline added that the rule includes strategies, responsibilities, anti-fraud practices and quarterly reports to the board, although some changes would begin on December 1. The operational reading is clear, fraud stops being only a customer service issue and becomes a corporate governance risk. In control terms, this requires stronger internal coordination between fraud, compliance, risk and technology.

Pensioner scams, calls and emptied accounts

Argentina also showed a very visible social layer of fraud in October. A local outlet described a tactic in which criminals pose as the BCRA, banks or wallets through calls claiming there are problems with an account. The official advice attributed to the campaign was to end the contact and verify through official channels obtained independently, a basic but necessary recommendation in vishing campaigns.

iProUP's coverage added two relevant signals, although both should be read with methodological caution. On one hand, it said nine out of ten older adults would have been exposed to virtual scams. On the other, it reported a ruling ordering Banco Provincia to compensate a 75-year-old retiree after a scam tied to a TikTok ad. The material does not allow independent verification of the survey or every detail of the ruling, but it does reflect a pattern of abuse targeting users with lower digital resilience.

That same month, another report cited by El Observador said fraud reports received by the regulator rose 150% after information disclosure obligations were strengthened. That figure should not be read as equivalent growth in crime, but as a larger volume of recorded complaints. That distinction matters because it shows that part of the observable change may come from better incident capture rather than a real surge in attacks.

Bolivia, crisis simulation and AI-driven fraud

Bolivia produced one of the month’s most complete signals, combining police warnings, sector coordination and estimates of operational pressure. Banco Unión, Whalemate and the Association of Private Banks organized CiberLATAM Connect 2026 in La Paz, with presentations and a crisis simulation to strengthen response and coordination in the event of a cyberattack. The presence of a sector-wide coordination table is consistent with a market that sees fraud as a shared problem rather than a collection of isolated cases.

The Bolivian Police warned about links sent through WhatsApp and Telegram, fraudulent banking apps, voice cloning using artificial intelligence and threats used to obtain personal information and access bank accounts. That warning is relevant because it combines familiar techniques with a new layer of voice impersonation, something that can make a vishing attempt more convincing when the attacker uses audio samples or synthetic content.

At the same time, a national assistant manager for Information Security at Banco Unión estimated that attack attempts against financial institutions could reach between 1,000 and more than 10,000 per day. That figure reflects telemetry or an estimate of attempt volume, not confirmed incidents with impact, and it should not be added to the total number of events. Even so, it helps explain the daily pressure facing defenses, especially when the mix includes phishing, social-media impersonation and credential theft.

Chile and stronger authentication

Chile was another central focus, both because of the regulatory framework and because of the CMF's action against irregular operators. One report said that from August 1, 2026, certain mandatory use cases for Strong Customer Authentication were already enforceable under General Rule No. 538, applied to operations subject to Law No. 20.009. In parallel, another note recalled that the same rule establishes security and strong authentication requirements for certain electronic operations.

The technical debate, however, does not end with formal compliance. Netprovider warned that strong authentication does not necessarily mean phishing-resistant authentication, because a one-time code generated by an app can still be intercepted through an adversary-in-the-middle proxy. Diario Constitucional raised a similar concern about capturing a possession factor through vishing. The takeaway is that meeting the rule does not, by itself, eliminate advanced social engineering risk.

The CMF also filed a complaint with the Public Prosecutor's Office against three entities offering online loans that, according to the evidence gathered, requested advance payments without delivering the promised funds. In another report, the agency filed complaints against three websites for alleged fraud tied to online loans and issued alerts about the APP MICRO CRÉDITO and APP TESORO CASH applications, flagged as linked to extortion tactics and usurious collection practices. This shows a classic vector, fake credit, that still works because it monetizes the user's financial urgency.

Colombia and the rise of brand impersonation

Colombia showed a digital fraud campaign that stood out for its scale and the infrastructure used to support it. Impacto TIC reported an operation that used 288 fake domains to impersonate 47 brands, including financial institutions, digital wallets, payment collectors and utilities. The publication attributed the finding to a cybersecurity firm, and the case matters because it combines brand diversity with a broad and persistent infrastructure.

Semana's coverage added that the initially detected set would have grown from 51 domains to 288, with 246 IP addresses and 29 autonomous systems. Those figures come from threat intelligence attribution and do not by themselves describe confirmed financial damage, but they do reflect an operation built to scale and absorb partial takedowns. It was also said that the code used to impersonate 15 financial entities could include mechanisms to capture biometric data through photos or videos, a detail that increases the risk of identity theft.

On another front, El País Cali reported that Banco de Bogotá warned about fraud that combines text messages, calls and malicious links to impersonate well-known entities and obtain confidential data. The warning does not confirm an intrusion into the bank's infrastructure, but it does underscore that the problem lies in brand imitation and user capture, not in a collapse of corporate systems.

Mexico, Paraguay and the same pattern of fake credit

Mexico showed a clear continuation of fraud based on impersonating financial institutions. CONDUSEF warned about impersonation through phone calls, WhatsApp messages, emails and websites that appear official. López-Dóriga added the recommendation to verify registration and the matching details of the entity in SIPRES, and to distrust advance payments. The mix of channels is typical, the attacker presses through several avenues until the user's caution breaks.

Ámbito México reported that CONDUSEF linked the impersonation to four financial firms and described contact by phone, WhatsApp and email, in a context of fake loan offers and installment smartphones. El Imparcial, for its part, detailed an email campaign with fake tax receipts in PDF that could install trojans capable of diverting money from online banking, and added recommendations to validate invoices on the SAT portal. In both cases, the attacker's gain depends on urgency, trust and the habit of opening attachments.

Paraguay had two especially sensitive incidents. La Tribuna reported a scam based on fake social media ads promising preapproved loans for people listed in Informconf, redirecting victims to Telegram and demanding advance payments. The BCP clarified that it does not issue loans or contact individuals to offer services or request confidential data. Later, the Superintendency of Securities warned that Broker Mercosul is not registered or authorized as a brokerage firm, and pointed to a scheme using websites, Telegram and a supposed license from the former National Securities Commission.

Brazil and unauthorized card transactions

Brazil provided a fraud case closer to direct monetization through unauthorized transactions. The Civil Police of Brasilia and Bahia reported arrests in an investigation into electronic transactions made with data from about 400 credit cards belonging to customers of a cooperative financial institution. The estimated loss was 3 million reais, a scale that goes beyond attempted fraud and reflects materialized economic damage.

The value of this case is that it shows the persistence of card fraud in an environment where attention often centers on instant transfers or payment apps. The available material does not detail the exact technical vector, but it does confirm that reusing card data remains profitable when the attacker can combine credentials, e-commerce and weak validation friction. For the insurance sector, this type of fraud has indirect implications through higher claims, disputes and prevention costs.

Uruguay and tighter controls over electronic transactions

Uruguay closed the month with a reform that expands authentication and sets new controls over digital transactions. Since October 1, 2026, provisions of Circular 2.497 from the Central Bank of Uruguay have expanded the obligation of two-factor authentication for access to digital channels, transfers or third-party payments from bank accounts, off-site loan applications, off-site card purchases and access to, modification or updating of sensitive data.

In addition, Circular 2.497 sets controls to detect irregular operations, including alerts for attempts to change sensitive data and controls over devices and locations used in electronic transactions. The BCU also recorded 32,399 cybersecurity incidents in the first half of 2026, compared with 17,014 in the same period of 2025. That comparison does not describe October itself, but it helps explain why the regulator is tightening the authentication and observability perimeter.

Ferrere attributes the main changes to a 2025 and 2026 resolution and circular, while Telenoche mentioned exceptions for transfers between accounts held by the same owner, trusted contacts and public transport payments, although the exact scope requires confirmation in the official text. El País Uruguay added that multifactor authentication is linked to a decline in certain incidents, although without enough methodology to quantify the effect. The useful takeaway for the sector is that the regulatory change aims to close everyday use gaps, not just harden high-risk access.

Threats and active campaigns

Fraud and phishing

Fraud and phishing were the leading threat of the month and the axis around which the most verifiable incidents clustered. This was not just a matter of deceptive emails or messages, but of campaigns that combine multiple channels to strengthen the credibility of the impersonation. October cases show at least four recurring subtypes: vishing, smishing, phishing with attachments, and impersonation of platforms or financial brands through fake sites and cloned apps.

The most repeated pattern was financial urgency. In Argentina, calls that simulated problems with an account tried to pull the user out of the legitimate channel. In Chile, supposed online loan offers asked for upfront payments. In Paraguay, ads promised loans to people reported in Informconf and redirected them to Telegram. In Mexico, fake tax receipts in PDF format could install trojans and lead to the diversion of money from online banking. The objective changes in form, but not in substance, to capture the process before it reaches the bank.

There was also growing sophistication in identity theft and possible biometric capture. The Colombian case of Shadow Parasite suggests that the operation did more than imitate brands and may have tried to collect biometric data. In Bolivia, police warned about voice cloning using AI. And in corporate United States, Bank of America recommended not sharing banking passwords with AI assistants because of the risk of unauthorized use or leakage. Although that last case is not a regional incident, it does show where the problem is headed, toward fraud carried out through AI-mediated interactions.

Ransomware and extortion

No cases of ransomware or extortion were identified as the primary focus in the October material analyzed. There were also no events in which the source made it possible to distinguish asset encryption, exfiltration without encryption, or a simple mention on a leak site. That absence should not be read as proof that the region was unaffected, only as a lack of verifiable cases within the month’s corpus.

The only case close to the concept of extortion was Chilean coverage of supposed credit apps that, according to the report, would have combined collection pressure and usurious mechanisms. Even so, the available material does not describe ransomware or technical extortion of corporate assets. For banks and insurers, the risk reading is that the month’s operational focus shifted to entry-stage fraud, not disruption through encryption.

APT and hacktivism

No verifiable APT or hacktivist incidents were identified as a main axis in the October material for traditional banking and insurers in Latin America. Nor does the supplied corpus show campaigns with political motivation or long-term persistence aimed at this vertical. The clearest signal remains economic, not ideological.

Even without visible APTs, the layer of automation and AI agents mentioned in several notes should not be underestimated. The discussion around CyberCartel, reports of more than 400 targets in the region, and calls from multilateral organizations to strengthen safeguards against AI-enabled fraud point to a frontier that could shift from fraud campaigns to more complex attacks. For now, however, that hypothesis does not have sufficient confirmation in the material analyzed.