Traditional Banking and Insurers, August 2026

Active threats and campaigns

Ransomware and extortion

August reporting recorded four cases with ransomware or extortion as the primary focus. In two of them, asset encryption was confirmed. In the other two, the source did not allow a determination of whether there was encryption or only extortion with a threat to publish data. There was no single dominant campaign, only scattered references to groups and claims, with the clearest impact showing up in economic pressure rather than prolonged disruption of banking services.

For banks and insurers, this category was quieter than fraud, but no less important. The absence of a major confirmed encryption case in the vertical does not mean lower exposure. What the month shows is that ransomware remained present as a coercion tool and that the regional financial ecosystem continued to face extortion, even if the material analyzed did not always provide enough technical detail to classify each incident precisely.

Fraud and phishing

Fraud was the leading threat of the month, with 44 documented incidents. The repeated use of phishing campaigns, fake banks, deepfakes, SIM swapping, impersonation by phone, messaging, and QR codes confirms that the most profitable vector remained social engineering supported by trusted channels. There was no single dominant technique, but a mix of tactics adapted to the country, the channel, and the victim profile.

The regional pattern is consistent. In Argentina, BCRA notices, court cases, and interviews about fake websites overlapped. In Brazil, operational instability, fake call center fraud, Pix data exposure, and police operations were added to the mix. Bolivia focused on authentication and complaints about fake loans. Chile, Paraguay, and Peru also showed a broad range of impersonation and account-draining schemes. The common threat was the exploitation of credentials, identity, and urgency.

APT and targeted intrusion

The period's material does not show a clearly attributed APT campaign in the traditional banking and insurance axis. There are incidents involving fraud with internal credentials, police operations for unauthorized access, and cases of data exposure that could support later intrusion, but the available sources do not provide enough basis to describe a sustained advanced campaign against banks or insurers with solid technical attribution.

That does not reduce the risk profile, because the month left signs of preparation and tactical evolution. The combination of exposed data, abused legitimate access, and vulnerable mobile channels creates a favorable environment for focused intrusion. Even so, with the material available, the dominant category for the vertical remains fraud, not attributed advanced intrusion.

Critical vulnerabilities

No critical CVEs were recorded in the material analyzed for August 2026. That does not mean there were no critical vulnerabilities exploited in the region, only that none appeared in the sources provided for this report. The focus for the month was fraud, authentication, data exposure, and compliance, not software exploitation identified by CVE.

Regulation and compliance

Regulation was a major theme in August, and not just because of volume. The month recorded 25 documented regulatory moves, with notable changes in Argentina, Bolivia, Brazil, Chile, Colombia, and Peru. The common thread was clear, more authentication, more reporting, tighter third-party oversight, and faster response capabilities for incidents or fraud with financial impact.

Argentina and the BCRA

In Argentina, the BCRA published Communication A 8438 and another rule in the Official Gazette, as part of a package of regulatory communications for financial institutions. The source material does not spell out the full content, but it places the measures within the broader update of the system’s rules. That alone signals regulatory continuity in a month dominated by bank fraud and litigation.

Argentina’s regulatory agenda moved alongside a wave of warnings about deepfake scams, phishing, and account draining. That overlap matters because judicial pressure and regulatory pressure often rise together. When courts begin to support strict liability or contributory fault, regulators usually raise expectations for monitoring, authentication, and incident management. August showed both fronts at once.

Bolivia and two-factor authentication

Bolivia made visible progress on digital security. The SIN rolled out two-factor authentication for its Virtual Office and framed it within global cybersecurity standards. It also set up support channels for issues tied to the new model, which suggests awareness of the operational friction that an authentication change can create. The BCB, meanwhile, warned about fake QR-based loans and clarified that it does not offer loans or investments to the public.

The overlap between authentication and fraud is significant. The country is not only trying to harden controls, it is also trying to support users who could be locked out or confused by the security upgrade. For banking and insurance, that transition is useful because it points to a regional framework where MFA and user support move together.

Brazil, Pix, and crypto

Brazil added a dense regulatory agenda. The Central Bank was cited in coverage about new security rules for Pix and Drex, and about a real-time alert system for threats tied to crypto assets, in partnership with Hypernative. Some of those pieces come from corporate or market sources, so they should be read as signals of regulatory and technical direction, not as a confirmed final product promise.

The regulatory logic is still consistent. Brazil’s regulator is acknowledging blind spots, expanding coverage over the crypto market, and tightening controls on mass payment rails. That combination matters for the banking sector because it points to a higher standard for transaction monitoring, fraud prevention, and operational resilience. The Pix incident on August 23, even though it was not an attack, reinforced that agenda further.

Chile and the new cybersecurity law

Chile was one of the most regulation-heavy countries of the month. Law 21.663 and Decree 295 set reporting obligations at three hours, updates at 24 or 72 hours depending on criticality, an action plan within seven days, and a final report within 15 days. ANCI acts as a receiving authority alongside the National CSIRT, and fines for noncompliance can escalate depending on the organization’s category.

The material also shows that companies classified as PSE and OIV are speeding up monitoring and response projects. For banks and insurers, this is critical because compliance is no longer about having a document. It is about reporting quickly, with evidence, and with the ability to reconstruct the incident sequence. Chile is setting a maturity benchmark that will likely influence other markets in the region.

Colombia, disaster relief, and financial claims

Colombia’s Financial Superintendence published draft measures and relief steps for borrowers and policyholders affected by the earthquake, along with instructions to soften the impact of the disaster situation on financial consumers. The focus is not a cyberattack, but it does center on service continuity, claims handling, and regulatory response in an extreme situation.

For insurers, this block is especially relevant because it connects claims, credit, and customer service. When the regulator prioritizes expedited complaints mechanisms or relief measures, internal operations must be able to sustain short response times, case traceability, and consistent documentation. August delivered that signal alongside the fraud agenda, showing that regional financial compliance has become broader and more tactical.

Peru and tougher fines

In Peru, the material included SBS resolutions and coverage about new fines for banks, AFPs, and insurers. Although the listed sources do not detail the full scope of each resolution here, they do confirm a move toward tougher sanctions and a more severe supervisory environment. That fits with the rise of fraud through calls, messages, voice impersonation, and fake receipts.

The link between regulation and threat is direct. When a regulator tightens fines and supervision, the sector has to show that it understands operational risk and fraud as one chain of control. In August, Peru made that tension especially clear, especially in the digital payments and consumer banking ecosystem.

Countries and most affected subsegments

Argentina

Argentina was one of the month’s densest hotspots, both for fraud volume and for judicial and regulatory response. The material brings together BCRA alerts on deepfakes, phishing cases, SIM swapping rulings, X-based scams, and court decisions that assign strict liability or shared fault between bank and customer. It also adds growing reports of cyberfraud complaints in CABA.

By subsegment, the most repeated impact hit retail banking, home banking, wallets, and credit cards. Coverage of card cloning with fraudulent online purchases shows that classic fraud is still alive, even as it coexists with more modern techniques. The Argentine cases also put the evidentiary burden in the spotlight, with each ruling seeming to demand more from banks to prove they monitored activity and reacted in time.

Brazil

Brazil concentrated operational incidents, data exposures, police operations, and security updates tied to Pix and crypto. Pix instability, the Pefisa incident, Operação Rastro, Operação Klonen, and the crypto alert plan made for a month of heavy pressure on the financial system and its payment flows. It is no surprise that the Central Bank appeared in so many reports.

The most strained subsegment was payments and digital banking, followed by compliance and financial crime. The coexistence of electronic banking fraud, money laundering, and on-chain monitoring suggests the country is pushing for tighter integration between antifraud controls, AML, and technology supervision. For insurers, the direct volume impact is lower, but the exposure matters because of business continuity and the use of shared digital channels.

Chile

Chile combined strong regulation with expanding digital fraud. The Central Bank reported nearly US$98 million in unknown transactions or transactions reported as fraudulent during the first half of 2026, while the country advanced in implementing the Cybersecurity Framework Law and a national table against transnational financial fraud. That dual pressure, monetary loss and legal demands, captures Chile’s month well.

In subsegments, banks and payment systems were the most exposed, but the regulatory impact reaches all essential service providers and operators of vital importance. The removal of coordinate cards at several banks and the shift toward stronger authentication methods also point to a structural change in the financial user experience.

Bolivia

Bolivia showed a more focused agenda around authentication, fraud reporting, and institutional strengthening. SIN activated two-factor authentication, the BCB reported false QR-based loans, and the UIF appeared close to leaving the FATF gray list after correcting deficiencies. The strengthening of CSIRT Bolivia was also reported as part of a broader strategy.

The most visible subsegment was digital tax services, but the takeaway extends to the financial system as a whole. The push for stronger authentication and sector-specific response structures points to a region where banking will have to live with more formal reporting and support models. Bolivia did not have the highest number of incidents, but several carried high structural value.

Paraguay

Paraguay maintained a steady flow of emptied accounts, theft complaints, and prevention alerts. The material mentions specific victims, a lawmaker reporting a cyberattack, malware suspicions, and bank prevention notes. While the documented volume is lower than in Argentina or Brazil, the repetition of incidents shows meaningful exposure in the retail segment.

The most affected subsegment was personal checking and bank accounts, with heavy social engineering and credential theft. The variety of media outlets reporting the same pattern indicates that the issue has become part of the country’s everyday financial security coverage.

Peru

Peru showed a mix of consumer banking fraud, attacks through calls and messages, and regulatory pressure on banks, pension funds, and insurers. The appearance of voice spoofing, fake receipts, and synthetic identities in August coverage suggests a technical escalation in social engineering. It is a troubling sign because it combines automation with the exploitation of personal trust.

The insurance subsegment appears less because of its own incidents and more because of the regulatory and compliance environment. The mention of tougher fines and the context of fraud directed at end customers means the insurance sector must strengthen validation, document fraud controls, and payment oversight. The common vector remains identity, not just infrastructure.

Colombia

Colombia was not the country with the highest volume of banking cyber incidents, but it was an important regulatory hub. The Financial Superintendence published measures linked to natural disasters, loans, and insurance, and opened draft circular letters and relief measures for affected parties. The signal here is operational resilience and supervisory response rather than intrusion or mass banking fraud in the material analyzed.

The most exposed subsegment is insurance, because of the nature of the relief and claims measures. For banks, the lesson is that compliance and consumer service will face tighter regulation even outside cyberincident scenarios. That requires business continuity, mass service handling, and documentary evidence to be built into the same operating framework.

Trends and signals to watch

The comparison with July shows a sharp shift in pace and focus. Verified incidents rose from 63 to 125, fraud or phishing from 8 to 44, and regulatory moves from 19 to 25. The main signal is not just higher activity, but a shift from a regulatory-heavy agenda to one dominated by fraud, with greater visible impact on customers and higher legal costs for financial institutions.

The ransomware count held steady at four cases in both months, suggesting the threat remained present without becoming the vertical's main story. Fraud, by contrast, expanded much more sharply and spread across more countries and subsegments. That should push teams to prioritize tactical awareness campaigns, stronger authentication, and detection of unusual transfers, rather than reading August as a month centered on destructive malware.

The nature of legal risk also changed. The Argentine rulings and the mix of reports, fines, and rules in Chile show that judges and regulators are less willing to accept generic explanations. If a bank cannot prove monitoring, alerting, blocking, or timely response, the cost is no longer only reputational. It is also judicial, administrative, and in some cases, directly financial.

Recommendations for security teams

Security teams at banks and insurers should treat this month as a signal to tighten identity controls and fraud response, not just infrastructure defenses. The immediate priority is to review authentication flows, support channels, transaction monitoring, anomaly detection rules, and customer service guidance for impersonation by phone, SMS, messaging apps, and video.

First, defenses against SIM swapping, session theft, and mobile identity hijacking should be strengthened. Cases in Argentina show that a compromised phone number can be enough to drain accounts or speed up transfers. That means adding risk signals for device changes, new payee setup, SIM replacements, and urgent transactions to newly opened accounts.

Second, institutional impersonation needs to be treated as a recurring campaign. Fraud involving fake bank call centers, BCRA deepfakes, and fake QR-based loans shares the same foundation, it exploits trust in a brand and time pressure. The response should not be limited to broad awareness campaigns, but should include short, repeatable, specific messages inside the app, the call center, and complaint channels.

Third, fraud monitoring and AML compliance monitoring need tighter integration. Operação Klonen and the Brazilian electronic fraud case show that stolen money moves fast and is quickly dispersed. If fraud sees the event but AML arrives too late, the damage is already done. Cross-team visibility, along with shared playbooks, reduces that gap.

Fourth, it is key to review operational incident handling and partial data exposure. The Pefisa case shows that a limited leak can fuel later fraud without touching passwords or balances. That requires monitoring abuse of exposed data, accelerating notification to potentially affected users, and adjusting prevention rules in the following months.

Fifth, banks and insurers operating in Chile need to prepare their workflows for the reporting cycle of 3, 24 or 72, 7 and 15 days, depending on criticality and the type of agency. It is not enough to know the obligation exists. Teams need to practice who files, who consolidates evidence, who approves communications, and who maintains technical and legal traceability.

Sixth, customer service should no longer be a peripheral part of fraud response. August made clear that many attacks are resolved, or made worse, at that point. If the customer's first point of contact cannot verify, block, escalate, and document, the defense chain breaks. Real security in this sector starts before the transaction and ends after the complaint.

Frequently Asked Questions

What forces incident reporting to move faster in Chile, Brazil, and Argentina?

Chile is the most prescriptive case in the material, because Law 21.663 and Decree 295 set early warning at three hours, updates at 24 or 72 hours depending on criticality, an action plan within seven days, and a final report within 15. In Argentina and Brazil, there were rules and alerts, but the sources provided did not spell out a cycle this precise.

What type of fraud dominated the month, and which countries showed it most clearly?

Fraud and phishing dominated, with 44 verified incidents. They appeared most clearly in Argentina, Brazil, Bolivia, Chile, Paraguay, and Peru, through deepfakes, fake bank call centers, SIM swapping, fake QR-based loans, impersonation by calls and messages, and account drain.

Was there confirmed ransomware encryption against banks or insurers in the region?

The material recorded four cases with ransomware or extortion as the primary focus, two with confirmed asset encryption and two where the source did not allow the technical impact to be determined. The sources provided do not show clear cases of Latin American banks or insurers with verified encryption as the month’s main event.

Which country showed the most regulatory pressure on digital banking and payments?

Brazil, Chile, and Bolivia concentrated the most visible pressure, though for different reasons. Brazil strengthened Pix and moved forward on crypto alerts, Chile tightened incident reporting with Law 21.663, and Bolivia activated two-factor authentication and complaints over fake loans. If the operational scope over payments is the measure, Brazil and Chile stand out.

What should a bank review first if it wants to reduce exposure to these cases?

First, authentication and detection of identity changes, because several cases this month exploited SIM swapping, phishing, fake calls, and impersonation. Second, monitoring of unusual transactions and new payee registrations. Third, customer service scripts and blocking procedures, because early response was key in the most visible incidents.

Material limitations

This report was prepared exclusively with the material provided for August 2026 and only with facts dated within that month. No internet access or external sources outside the authorized list were used. The indicators reflect the base and time window stated above, and they do not add attempt telemetry or automated blocks, because the material did not provide figures of that kind.

A zero indicator, especially the critical CVE count, means that this data point was not recorded in the August 2026 material analyzed, not that no critical vulnerabilities were exploited in the region. The same applies to any thematic absence: it reflects the available corpus, not the full scope of real-world risk.

Ransomware and extortion were classified cautiously. When the source did not allow a distinction between encryption, exfiltration, or a simple mention on a leak site, that uncertainty was noted in the analysis. Consumer social media and sponsored or commercial posts that are not included in the approved source list were also excluded as evidence.

The indicator window was August 2026. Facts from earlier months, including comparisons with July, were used only for contrast and always with the corresponding month stated explicitly. Sectors are not exclusive, so the same event can affect more than one subsegment of the vertical, especially when it involves a mix of banking, telecom, payments, and compliance.