Will Brazil’s New Scams Regulation Drive Change in Latin America?

In my previous post I highlighted the move set forth by the Central Bank of Brazil (Banco Central do Brasil) in May of 2023 with Resolution 6 that requires financial institutions, payment institutions and other institutions authorized to operate by the Central Bank of Brazil to collect data on fraudulent transactions and to share that data. Specifically, Resolution 6 requires the collection and provision of the following information:

• A description of the probable cause of the occurrence or attempt of fraud
• Those who have allegedly carried out the fraud or attempted to do so
• The recipient financial institution
• The recipient account and the associated account holder

This measure falls closely in line with the move by the Payment Service Regulator in the UK in March of 2023 and the announcement by the European Union for data sharing in June of 2023. The measure in Brazil has been live since November of 2023.

In our discussions with several fraud management leaders in Brazil, it was a common viewpoint that this move by the Central Bank of Brazil was not “a one and done” move to combat scams, but the first step in a wave of further government regulations to tackle the rampant problem of scams in Brazil.

The whole of Latin America has become one of the favorite playgrounds for scammers, with Mexico in particular being a top target. So, given the recent government regulations in Brazil, what is the current and future state of regulation in the rest of Latin America? In this post we’ll take a deeper dive into:

• The fraud landscape in several Latin American countries
• What the real-time payments ecosystem looks like in Latin America
• What moves have been made by the local regulators
• The actual size of the scams problem
• How Latin America compares to other regions
• What fraud leaders in Latin America should be thinking of to combat and protect consumers against scams

A Common Threat

Mexico is consistently ranked as one of the countries, surpassed only by Brazil. From FICO’s own 2023 Scams Impact Survey: Mexico, 59% of Mexican consumers say family or friends have been victim of scams. 63% of Mexicans got an unsolicited text, email, phone call or other outreach that they thought was part of a scam.

Turning to Colombia, the picture is also somber. From the same survey focused on Colombia, 65% of Colombians say family or friends have been victim of scams. 73% of Colombians got an unsolicited text, email, phone call or other outreach that they thought was part of a scam. As of 2023 Colombia was the most targeted nation in Latin America in terms of scams involving cryptocurrency. This can largely be tied to the high level of growth of adoption of cryptocurrency in Latin America. With the growth of the payment method, so grows the fraud.

Lastly, when we look at Peru, we see a similar story. Taking a look at the stats from Peru, 56% of Peruvians say family or friends have been victim of scams. 76% of Peruvians got an unsolicited text, email, phone call or other outreach that they thought was part of a scam. 

The examples of Colombia, Mexico, and Peru show the extent to which scams have spread through Latin America. But the threat is common across the region. As Latin America’s digital inclusion has progressed (80.5% internet penetration rate in 2023, which is above the global average of 67.9% and only behind Europe and North America), new opportunities for scammers have grown alongside. The internet in fact allows scammers to utilize new technologies to commit fraud 24/7, anonymously, fully automated and at scale. The scenario in Latin America largely replicates the experience in the UK, where UK Finance data shows that 70% of reported Authorized Push Payment (APP) scams originate through an online platform. 96% of investment scams and romance scams originate online and that figure rises to 98% of all purchase scams. Simply put, it’s much easier to commit scams through an online experience than face-to-face.

A Common Desire to Emulate Pix

Because of the massive success of Pix in Brazil, where Pix transactions topped 3 billion monthly transactions in March of 2023, there is a common desire in a number of Latin American countries to emulate the success of Brazil. Throughout the region we see countries in various stages, from planning to live.

Mexico currently has 3 RTP systems: SPEI introduced in 2004 (requires having a bank account), CoDi (QR code based, P2B or B2B transactions) introduced in 2019 and DiMo (Dinero Móvil – phone number based, P2P transactions) launched in September of 2023, which has been dubbed the ‘Pix of Mexico’. Although Mexico is no stranger to RTP transactions, the volumes are much smaller currently than Brazil. As a comparison to Pix, CoDi transaction volumes were only 55,685 for the month of September 2023 and SPEI transactions were 316 million in August of 2023. DiMo transactions are expected to grow as adoption grows.

With Resolución Externa 6 (issued in October of 2023), the Banco de la República (Colombia’s central bank) issued its first set of financial institution interoperability parameters for low-value payments, setting out the regulatory foundation for Colombia’s first Single Payment Interface (SPI) and therefore setting the wheels in motion to create their own version of Pix.

Peru implemented its real-time payment rail systems, IRT (Immediate Interbank Transfers), however consumer uptake remains relatively limited with RTP representing 0.3% of total transaction volume in 2022. Peru’s Electronic Clearing House (CCE) is working on their own Pix like system that will allow for the transfers by use of phone numbers.

With the moves by these countries and others in Latin America to achieve greater financial inclusion through systems like Pix, with the growth in adoption of real-time payments we can expect a further growth in the level of scams as has been the experience in the UK and Brazil.

A Lack of RTP and Scams Regulation Across Latin America

Colombia, Mexico & Peru share not only a common threat of scam activity, but they also share a lack of current regulation to address the problem of scams and any proposed framework to address the problem. The issue runs deeper as it is not just scams that are not being adequately addressed in Latin America, but cybercrimes in general are not being taken fully into account by multiple countries. The International Telecommunications Union’s Global Cyber Security Index noted that 28 countries in the region have provided no incentives to improve private cybersecurity and 17 countries lack a national cybersecurity strategy to address critical infrastructure.

This lack of regulation and framework, combined with a population that is more and more online and scammers that are better armed than ever before with AI tools (deep fakes for image/voice/video, malicious chatbots, modeling capabilities as a service, viruses coded and customized by AI, etc.), creates the perfect storm for the current explosion and further growth of scams. 

Turning again to FICO’s 2023 Scams Impact Survey: Mexico we see that the expectation of most customers is that their bank will reimburse them in the case of a scam (72% of those surveyed expect that they are refunded most of the time).

The results from the Colombia and Peru surveys paint a similar picture: 67% of Colombians and 70% of Peruvians expect to be refunded most of the time. We have seen in other countries that similar consumer sentiment regarding the refunding of scam victims has ultimately led to consumer advocacy groups pressuring their local regulators to act.

Latin America Lacks a Common Understanding of the Scale of the Scams Crisis

This lack of regulation and reporting standards in Latin America leads to the question of whether there is a true understanding of how big the problem is. Scanning through articles in the press we see examples such as “15,000 bank frauds per day” or ”15% of the population has already been victim of a scam” in Mexico. These types of stats likely don’t encompass all the scams that have occurred.

When we look at the UK, we see that UK Finance has clearly defined what a scam is, the types of scams and what needs to be reported to the regulator for quantifying the scale of the problem. This level of common definition and requirements to report is simply lacking in Latin America.

How Latin America Compares to Other Regions

In a new blog post by my colleague, Szymon Morytko, he noted that Australia, Hong Kong and Singapore are all developing differing types of regulatory approaches to tackling scams, but all agree that scams need to be addressed. What we see in these countries is that they are developing the approach that fits the need of their population and financial system, rather than blindly copying the approaches of the UK and EU.

In my opinion the increased digital customization, customer expectation around faster payments and growth in scams will eventually force regulators to take action in Latin America. The experience from Asia-Pacific shows that the form of regulation may take different paths. The direction taken could be on the path of:

• Consumer empowerment
• Data sharing
• Cross-industry collaboration
• Liability sharing

What Fraud Leaders Should Be Thinking of to Combat Scams

A population that is increasingly online, demand for faster payment systems such as Pix, AI tools that super-charge fraud and a world where there is increased pressure for regulatory action to combat scams — these should be the catalyst for fraud leaders to reflect upon how well their financial institution is positioned to handle these forces.

Based on what we’ve seen worldwide, financial institutions thinking ahead in the regulation game and helping drive conversations with regulators are most poised for success when change occurs.

Besides driving the change and not letting the change happen to you, we think fraud leaders should be considering the following points:

1. Data Sharing & Collaboration

From a data sharing perspective, Brazil has been at the forefront of this topic in Latin America. We have not yet seen other countries in the region moving as far. It would be wise for fraud leaders in other countries to understand what is happening in Brazil and other countries in terms of data sharing, as it’s my strong conviction that data sharing on scams will also be required in other areas in Latin America. The rapid spread of this requirement to multiple geographical locations in the last two years has only reinforced this conviction.

Furthermore, this data sharing may also morph into cross-border collaboration. In September of 2023 the U.S. Federal Trade Commission (FTC) signed a multilateral agreement with Chile, Colombia, Peru and Mexico called the Multilateral Memorandum of Understanding in Americas. The main goals of the memorandum are to “promote cooperation across Latin America, including information-sharing to further investigations and policy development, as well as other types of assistance on cross-border enforcement matters”.

The moves by Brazil and other countries to enforce data sharing on scams along with the aforementioned cross-border FTC collaboration show that this not a temporary move, but a sea change that cannot be ignored.

With this sea change, fraud leaders should be asking themselves the question: Are my fraud tools flexible enough to ingest any sort of information and utilize it in my transaction decisioning in real time?

2. Liability 

When the UK announced the 50/50 liability proposal regarding scams, this marked a dramatic shift on who is responsible when a scam occurs. Currently, no country in Latin America has announced something similar. However, this should be considered as a potential development for the region. Bear in mind that the UK proposal was only announced in July of 2023. We’ve since seen other countries announcing changes around liability.

If a similar stance towards liability takes place in Latin America, financial institutions will need to potentially invest further in their application fraud controls. Otherwise, they will be held responsible from not only a reputational perspective but also a financial loss perspective for those customers who have used their accounts for the purposes of scams.

In short, the question fraud leaders should ask themselves is: Do my application fraud controls stand up to a world where the liability is not all the responsibility of the customer from the originating institution?

3. Technological Advancements

Looking into the future, we will witness an increased focus on the role of technology not just as a tool for fraud detection but also as a means of fostering safer digital transaction environments. Advancements in AI and machine learning will play significant roles in future regulatory frameworks, offering more sophisticated and proactive solutions to detect and prevent scams. We’ve seen the pace at which AI has been moving over the past year – we need to ensure our tools are keeping up with the technology and not left behind. Therefore, fraud leaders should be asking themselves another set of questions:

• Do I have the means to customize my customer communication based on a plethora of factors and variables, build intelligence into the messaging, and adapt it to new circumstances at a minute’s notice?
• Do I have the right tools to use the great models my team is building in-house, or do I get hampered by inefficiencies and technological restrictions that prevent me from deploying these models into production?

FICO’s fraud consulting team stands ready to help customers in Latin America address the issues raised by scams and new regulations.

How FICO Helps Detect and Prevent Scams

• Explore FICO’s innovative fraud protection technology
• Learn how real-time customer communications can help stop fraud
• Read about FICO’s award winning, machine learning-powered retail banking model with scam detection score
• Download the FICO 2023 Scams Impact Survey