LATAM deepfakes and phishing hit businesses

Update November 4, 2026: Unico and Liminal added new data on synthetic identity fraud in Latin America, where it now accounts for 48.3% of the markets analyzed. IRONSCALES also released updated figures on the cost of deepfake attacks, with average losses above $280,000.

Unico and Liminal reported that synthetic identity represents 48.3% of fraud in the Latin American markets they analyzed, a share that exceeds the global average for sophisticated attacks. At the same time, IRONSCALES said its study, Beyond Detection: The $280K Reality of Deepfake Attacks, found average losses above $280,000 among affected organizations.

How are these techniques being used?

Available reporting points to two main vectors, impersonation through fake videos and advanced phishing backed by AI. According to analysis published by Ikusi, these techniques can clone the voice, face and writing style of executives, vendors or customers to try to authorize fraudulent payments or obtain sensitive information.

In Colombia, El País Cali reported concern over fake posts using deepfakes that replicate the features of well-known people to push economic scams. In Peru, The Latin Times said deepfakes are already a risk for critical business processes, including payment approvals, executive communications and vendor management.

What do the new fraud figures show?

The Unico and Liminal reports suggest synthetic identity fraud already carries significant weight in Latin America. Unico said that in the markets analyzed, this method represents 48.3% of fraud and exceeds the global average for sophisticated attacks.

Liminal confirmed the same percentage in its own analysis and added that the joint study with Unico attributes a more than 100-fold reduction in the cost of carrying out sophisticated attacks. The takeaway from both publications is that automation and AI are making attacks cheaper and increasing the scale of fraud attempts.

What cost did deepfake attacks leave behind?

IRONSCALES said its study, Beyond Detection: The $280K Reality of Deepfake Attacks, found average losses above $280,000 among affected organizations. The company said 19% reported losses of $500,000 or more, and more than 61% reported losses above $100,000.

That kind of financial impact matches the regional warning around deepfakes and generative phishing. These threats are no longer limited to mass deception campaigns, they are also being adapted to internal company processes, vendors and authorities, with high costs when fraud succeeds.

What is the regulatory debate in Ecuador?

Research from the Pontifical Catholic University of Ecuador concludes that the COIP lacks an explicit rule for AI used in fraud and proposes reforming Article 186. The proposal adds the use of artificial intelligence as an aggravating factor, but requires proof of direct intent and a qualified forensic computer exam.

The approach aims to give a more precise criminal basis for cases in which automation or synthetic generation is part of the fraud. The academic work also links this to the principle of legal certainty, in a context where the offensive use of these tools is already appearing in several countries in the region.

What does the Mexican case show?

Infobae Mexico reported, based on accounts released about the case, that the cybercriminal group Chronus allegedly used automated tools and AI-backed capabilities to inspect infrastructure linked to Mexican institutions, identify vulnerable subdomains and exploit weak points. That point remains framed as attributed to reports that have not been officially confirmed.

The regional reading from these sources is clear: deepfakes and generative phishing are no longer limited to mass deception campaigns, and they are being adapted to internal processes at companies, vendors and authorities. The debate in Ecuador, meanwhile, points to filling a specific legal gap for this type of fraud.