Neobanks, FinTechs, and PSPs, September 2026

Active threats and campaigns

Ransomware and extortion

September saw four cases in which ransomware or extortion was the primary focus, but the material does not allow a precise classification of the impact in any of them, so the source does not specify whether assets were encrypted. The key point here is not just volume, but the technical ambiguity of the sources and the difficulty of separating encryption, exfiltration, or simple claim-making.

One of the most cited references was SCILabs' report on ransomware in LATAM during the first half of 2026. La Jornada said the report recorded at least 290 formal attacks in the region and approximately 52 Mexican companies and entities targeted, with financial services among the affected sectors. That does not belong to September's operational volume, but it does help explain the context in which the month's alerts moved.

In the Revolut case, the mention of a US$3 million ransom appears in press coverage and third-party reconstructions, but the material does not establish an independent confirmation of encryption or completed extortion. For this report, the useful classification remains a leak with possible associated extortion pressure, not confirmed ransomware.

Fraud and phishing

Fraud was the category most covered by the sources this month, although not the largest by volume. The evidence ranges from BREEZE COMET and its fraudulent transfer activity to phishing campaigns, malware, and payment impersonation in Mexico and Brazil. The common pattern is that the attacker does not need to destroy systems to extract value.

What changes is how access is turned into money. In Brazil, the target was payment channels and the manipulation of legitimate transactions. In Mexico, impersonation and fake apps seek credentials, codes, and device control. In Paraguay, cyberfraud appears as a matter of institutional oversight and review. These are different expressions of the same pressure on operational trust.

The reading for PSPs and fintechs is simple in theory and hard in execution. If fraud can happen inside a legitimate flow, defense cannot rely only on perimeter controls. It requires visibility into every device change, every support request, every session token, and every transfer that falls outside the customer's historical profile.

APT, intrusion, and credential abuse

Although the material does not describe a classic APT against neobanks or PSPs, it does show persistent intrusion and credential abuse as an attack pattern. BREEZE COMET built backdoors, used privileged access, and operated on banking software. Casbaneiro, on another scale, combines email, lures, and fake windows to reach credentials and active sessions.

The difference from a ransomware incident matters. Here the goal is not to block operations and demand payment, but to infiltrate, persist, and monetize. That makes segmentation, anomaly detection, human validation of sensitive changes, and hardened remote support the most valuable defenses.

Critical vulnerabilities

No critical CVEs were recorded in the September 2026 material reviewed. That does not mean critical vulnerabilities exploited in the region were absent, only that none were verifiably mentioned in the sources for this period.

Regulation and compliance

September brought a clear regulatory shift in Argentina, Colombia, and Brazil, with direct implications for banks, fintechs, and PSPs. The biggest signal was that fraud risk management is no longer treated as an optional best practice, but as a structural requirement of the compliance architecture.

In Argentina, BCRA Communication A 8471 set the first stage of the operational risk management and fraud prevention framework between September 1 and December 31, 2026. The Official Gazette said entities must define structure, policies, owners, risk appetite, and risk tolerance, as well as identify risks tied to products, services, processes, and digital channels. For certain PSPs, the timeline extends gradually through September 2027.

That same ecosystem expanded with the implementation schedule for administrators of instant transfer schemes and for financial institutions and PSPs that offer payment accounts. Operationally, the regulation now begins to require measurable governance over fraud, not just retrospective reporting. Revolut’s case, after receiving approval from the Central Bank of the Argentine Republic, also shows that market expansion now comes with regulatory and operational requirements before launch.

Brazil also strengthened the compliance layer, although through fraud response. Procon-SP instructed consumers to seek a response and reimbursement through MED 2.0 when they detect fraudulent Pix transfers or altered QR codes. This is not a hard regulatory change, but it is a clear message about the responsibilities of banks, payment institutions, and merchants in complaint handling.

In Colombia, the Financial Superintendency advanced a roadmap for open finance, supported by seven technical working groups and the participation of more than 157 entities. The focus is on publishing a schedule to issue information exchange standards and gradually implement the scheme under Decree 0368 of 2026. For fintechs and PSPs, that means more interoperability, but also more pressure on APIs, data governance, and authentication controls.

Paraguay showed a different signal, one centered on supervision and accountability. The Senate’s request to the BCP regarding cyber fraud and information security controls reinforces the message that entities must be able to explain not only what happened, but how they audit, correct, and document their findings.

Countries and most affected subsegments

Brazil

Brazil had the month’s strongest signal, both in volume and severity. The BREEZE COMET campaign, the BRBJUS incident, Procon-SP’s warning about QR Code Pix, and the technical debate on fraud prevention in instant payments all converged there. There were also signs of persistence, backdoors, and privileged-access abuse, making this market a reference point for the rest of the region.

The key issue in Brazil is that risk cuts across banks, PSPs, banking software, and payment infrastructure administrators. This is not a single perimeter. What keeps recurring is the possibility of turning initial access into a valid transaction, which forces a review of support, monitoring, and out-of-band validation.

Mexico

Mexico remained a high-volume front for digital fraud, phishing, and banking malware. Milenio’s report on 6.3 million claims provides a sense of scale, while coverage of Casbaneiro and alerts from ABM and Condusef show that credential abuse remains highly active.

There is also a sector-specific reading. The incidents are not limited to banks, but extend to end users, mobile devices, and customer service channels. That is pushing fintechs and PSPs to strengthen authentication controls, transactional anti-fraud measures, support-simulation detection, and customer education with an operational focus, not just a communications one.

Paraguay

Paraguay stood out for supervision and for exposure to cyber fraud as a public agenda issue. Parliamentary scrutiny of Itaú Paraguay and the BCP does not amount to a confirmed incident, but it does show growing pressure on traceability, audits, and controls.

For the banking subsegment, this matters because regulatory risk grows when user complaints reach the political sphere. Entities that cannot explain their investigation, escalation, and remediation processes will face a reputational cost greater than the purely technical one.

Argentina

Argentina combined regulation and market expansion. Communication A 8471 sets concrete obligations for the first stage of the operational risk and fraud framework, while Revolut obtained approval from the Central Bank to prepare a future launch.

The case matters for neobanks and PSPs because market entry is no longer measured only by product or commercial traction. It also depends on proving minimum controls, risk functions, governance, and the ability to meet phased regulatory timelines.

Colombia

Colombia showed more of a structural transformation than a single incident. The open finance roadmap and technical work with more than 157 entities point to a more interconnected ecosystem, with information-sharing standards and greater reliance on APIs.

That brings opportunities, but also a broader attack surface for fraud, credential abuse, and integration failures. For fintechs, the message is that interoperability only works if data security and authentication are built in from the start.

PSPs, fintechs, and banking software

In the PSP and banking software subsegment, the month’s material points to a very clear pattern. Attackers are not necessarily trying to break encryption or exploit notable CVEs. They are looking for access, operational context, and the ability to sign or divert transactions through legitimate channels.

That behavior increases exposure for payment gateway providers, integrators, banking software developers, and payment scheme administrators. If an actor compromises that layer, the impact spreads beyond a single institution and can affect several clients at the same time, even if the initial event occurs in just one environment.

Trends and signals to watch

Compared with August, September showed fewer total incidents, fewer unclassified incidents, and fewer fraud or phishing cases, but not a real reduction in risk. What changed was the shape of the signal. September brought less quantitative noise and clearer evidence of certain high-value vectors, especially payment manipulation, privileged access abuse, and regulatory compliance.

The first trend to watch is the consolidation of attacks that use legitimate payment systems as a monetization channel. BREEZE COMET captures that shift well. If an attacker can operate from privileged accounts and present valid transactions, the problem is no longer purely about malware. It becomes a governance issue tied to access, behavioral monitoring, and segregation of duties.

The second signal is the growth of transactional fraud through consumer-facing interfaces. QR Pix fraud in Brazil and fake apps in Mexico show that the end user remains the weakest point when recipient or device validation is not locked down. That requires more visibility into session risk, device binding, and stronger confirmation steps.

The third trend is regulatory. Argentina, Colombia, and Brazil are moving in different directions, but with the same underlying theme, more accountability for fraud, interoperability, and controls. For risk and compliance teams, the month shows that the ability to report, document, and remediate will matter as much as the ability to prevent.

Security recommendations for teams

Security teams at neobanks, fintechs, and PSPs should prioritize four areas this week. First, review any workflow that allows remote support, elevated privileges, or administrative access to payment consoles. Second, tighten validation for high-risk transfers with out-of-band controls and behavioral analysis. Third, audit the integrity of QR codes, payment links, and e-commerce redirects. Fourth, align risk and documentary evidence with the new regulatory pace.

In environments with Pix, STR, Boleto, or equivalent schemes, it makes sense to deploy alerts for recipient changes, privileged account use outside business hours, unusual rule creation, and burst transactions. The BREEZE COMET logic shows that an actor can move from access to monetization very quickly, so detection has to happen before clearing or settlement.

For mobile fraud and account takeover, the most useful control is often the least glamorous. Phishing-resistant authentication, device attestation, strict session management, emulator detection, and reauthentication logic for sensitive changes. Asking users for a strong password is not enough if the flow later allows transfers with weak identity signals.

On the vendor side, the focus should be on third parties with the ability to touch payments, KYC, or support. If a provider concentrates critical functions, it should be subject to response tests, access revocation tests, and contingency exercises. The BRBJUS case shows that a service can fail in an external environment and still drag down the operation, reputation, and continuity of the entity using it.

Finally, compliance teams should map Argentina and Colombia's timelines now, along with Brazil's operational alerts. The question is not only whether the control exists, but whether it can be demonstrated with evidence, owners, and deadlines. September made clear that regulators and the market already expect that capability.

Frequently Asked Questions

Which country concentrated the most sensitive signal for PSP and digital banking this month?

Brazil concentrated the most sensitive signal because it combined an active campaign against payments, an incident in BRBJUS, and fraud alerts tied to Pix. That mix brings operation, continuity, and fraud into the same market. The full reading is in the Relevant incidents, Active threats and campaigns, and Most affected countries and subsegments sections.

Was ransomware confirmed against neobanks or payment processors?

The September material does not show confirmed ransomware against neobanks or PSPs, although it does show four cases with a primary ransomware or extortion focus. In those cases, the source does not specify whether there was asset encryption, exfiltration without encryption, or only a mention on a leak site. See the Period indicators and Active threats and campaigns sections.

What is the link between mobile fraud and Brazil's payment incidents?

The link is operational, not just reputational. The QR Code Pix alerts and the BREEZE COMET campaign show that fraud can happen at the payment interface or inside privileged accounts, without needing to break an entire system. The overlap is covered in Relevant incidents, Brazil, and Security team recommendations.

What changes for fintechs with regulation in Argentina and Colombia?

The bar is raised for governance and interoperability. In Argentina, the BCRA has already set the first stage of the operational risk and fraud prevention framework. In Colombia, the Superfinanciera is advancing standards for information exchange and open finance. The details are in Regulation and compliance and Trends and signals to watch.

What should a compliance team look at after complaints such as those in Paraguay?

It should look at traceability, internal investigations, corrective measures, and response capacity before the regulator. In Paraguay, the Senate asked the BCP for information on disciplinary proceedings and complaints of cyber fraud against Itaú Paraguay, although no specific technical incident was confirmed. That overlap appears in Relevant incidents, Regulation and compliance, and Most affected countries and subsegments.

Material limitations

This report was prepared exclusively from the material provided for September 2026, with no internet access and without adding aggregated telemetry or sources outside the authorized list. The time window for the indicators is strict, 59 dated facts in September 2026, and no facts from other months were included in the main count.

A zero indicator, especially for critical CVEs, means no critical CVEs were recorded in the material analyzed for this period. It does not mean there were no critical vulnerabilities exploited in the region, only that there was no verifiable mention in the sources received.

The threat breakdown and incident counts reflect the classification supported by the material, not a full forensic audit. In several cases, the source does not specify whether there was encryption, exfiltration, or only a claim of responsibility, so the ransomware and extortion taxonomy should be read with that limit in mind.

Also excluded from the valid evidence were sources not included in the allowed citation list, consumer social media posts, and sponsored or commercial content when that was the only basis for a claim. When there were partially attributed versions, they were kept as such and not treated as full independent confirmations.