.Over the course of the last year, financial institutions in Panama, Costa Rica, and Guatemala have seen fraud evolve from more isolated attacks into coordinated, multistage fraud chains. 

A typical event now begins with data exposure or data capture, continues with customer manipulation or credential compromise, escalates into account takeover (ATO) or authorized push-payment (APP) fraud, and ends with the dispersal of funds through networks of mule accounts.

1. Data capture: The first link in those chains (data exposure) is no longer limited to using someone else’s data to open fraudulent accounts. Identity theft in Central America today uses that stolen or exposed personal data to create more personalized scams. Criminal groups now know where potential victims bank, the kinds of accounts they have at that institution, and, often, their full names, ages, and physical addresses.
2. Credential compromise: Attacks often then progress to credential compromise, as organized criminal groups utilize fake SMS messages, emails, and phone calls to seize control of a legitimate account holder’s access credentials. In corporate banking, attackers often seek authorization credentials that let them bundle multiple payments to different recipients under a single authorization code.
3. ATO and APP fraud: While the rapid digitization of banking services and, in some cases, the hasty adoption of remote channels without robust authentication processes has left accounts vulnerable to ATO, social engineering attacks remain the more elusive threat. Bad actors increasingly manipulate potential victims into legitimately logging into their accounts and willingly transferring away their money, rendering rules-based detection systems essentially useless.
4. Mule networks: Every fraudulent transfer requires a mule account to receive it. That recipient account will then disperse the funds through dozens of other accounts, often across multiple institutions, before the organized criminal group behind the attack can withdraw the money they’ve taken or convert it to crypto. Criminal organizations in the region take advantage of labor informality, poverty, and false job offers to recruit mules. The expansion of e-commerce and digital payment platforms make it easier for criminals to move funds quickly, while weaknesses in bank due diligence processes and limited regional coordination allow mule networks to operate with minimal risk of detection.

.Incoming Regulation

In response to the increasing sophistication of these attacks, Central American countries have begun to implement regulatory changes ranging from stronger authentication requirements to the potential imposition of penalties or liability on financial institutions when their customers fall victim to scams or credential theft. Many of these initiatives are aimed at following the money, identifying where fraudulently obtained funds move and recognizing that, in many cases, these attacks are driven by organized criminal operations.

• In Costa Rica, banks must now be able to demonstrate what happened and how they protected the user. Increasing fraud rates in the country may be due in part to higher reporting levels driven by this new regulation, a stronger perception of consumer protection, and the possibility of recovering stolen funds.

• In Panama, the focus is on strengthening criminal prosecution and building stronger evidentiary cases for digital crimes, from impersonation to cyber-enabled scams. The country’s seen significant growth in scams, WhatsApp account takeovers, and fake purchases, which is resulting in more cases and complaints.

• In Guatemala, regulatory developments are encouraging a more integrated view, where fraud is not treated in isolation but is connected to mule accounts and money laundering. Identity-based fraud remains a central concern in the country. Account opening, login, account takeover, phishing, smishing, vishing, impersonation, mule-account activity, and abuse of electronic channels continue to create risks for banks, fintechs, payment providers, and their customers.

To meet and stay ahead of these obligations, Central American financial institutions must implement consistent controls, compile auditable evidence, and ensure true coordination across fraud, cybersecurity, compliance, operations, legal, and customer service teams.

Behavior and collaboration

There are two practical ways to strengthen fraud prevention without creating excessive friction for digital banking users.

1. The first is the use of behavioral intelligence to identify behavioral anomalies and detect credential theft before any money leaves the would-be victim’s account.
2. The second is to complement these behavioral insights with a risk profile of the receiving account, enabling sending institutions to detect risk signals on the beneficiary side and act with visibility into both ends of the transaction.

This chain requires institutions to move away from fragmented controls and toward integrated prevention models that combine identity, device, behavior, transaction, beneficiary, account-network risk, customer education, and operational response.

Key takeaways:

• Fraud in Central America increasingly follows organized chains that connect stolen personal data, credential compromise, account takeover or scams, and the movement of stolen funds through mule networks.
• Costa Rica, Panama, and Guatemala are strengthening fraud regulation, with a growing emphasis on consumer protection, criminal prosecution, accountability, and tracing illicit funds.
• Financial institutions need integrated defenses that connect fraud, cybersecurity, compliance, operations, legal, and customer service rather than addressing each stage of an attack separately.
• Behavioral intelligence and beneficiary-account risk can give banks visibility into both sides of a transaction, helping them detect credential theft and suspicious payments before funds reach criminals.

Resources:

• Report: 2026 Digital Banking Fraud Trends in Latin America
• Bank of Guatemala: Resolutions from the Bank of Guatemala and the Monetary Board
• Consortium Legal: Guatemala approves new comprehensive law against money laundering and terrorist financing