Colombia

In the national statistics office's 2024 coexistence survey, covering 2023, 2.5% of men and 2.5% of women who had used a device to go online had a digital security incident. The highest share was among people aged 25 to 54, at 2.9%, against 1.7% at ages 15 to 24 and 2.1% at 55 and over. The office counts 833,000 people aged 15 and over in that group, 396,000 men and 437,000 women. Among the 13 cities it reports on their own, Villavicencio had the highest rate, 5.2%, and Bogota 4.5%.

The most common incidents were a hacked email or social-media account, 33.2% of those people, and bank fraud by electronic means, 32.4%. Identity theft or impersonation was 19.3%. The industry and commerce regulator describes impersonation as someone using another person's data to take out a product or a service, especially a phone line. From 2022 to May 2026 it received 13,983 impersonation claims on its facilitation platform, and 11,365 of them, 81%, were about telecommunications. Its warning of 23 June 2026 describes the approach as a message or a call that demands a quick answer, a request for a verification code, or a link.

On the banks' 2025 claims, debit cards were 51.2% of cases, credit cards 24.9% and digital channels 23.5%. Digital channels held 56.0% of the money. The police say the three most reported computer crimes in 2025 were theft by computer means, breaking into a system, and misuse of personal data, together 62,299 complaints and 88% of that series.

Most of the money in the banks' 2025 fraud claims moved on digital channels, which were 23.5% of cases and 56.0% of the amount. Debit cards were the most common case, 51.2%, and 16.3% of the amount. Credit cards were 24.9% of cases and 22.3% of the amount. Internet operations were 83.8% of the transactions customers disputed and 79.6% of the disputed amount. In the coexistence survey, electronic bank fraud was 32.4% of digital security incidents.

Bre-B, the central bank's instant payment system, has run at every hour since 6 October 2025. A transfer can be as large as COP 12,110,000, equal to 1,000 basic value units, and each institution may set a lower amount or a limit on how many transfers a customer makes. By March 2026, 350 million transactions and COP 54.3 trillion had moved through it. In September 2026, 76% of transactions were under COP 100,000, and 1 October alone saw 10.4 million. Before the money leaves, the system shows a masked form of the recipient's name and waits for a confirmation.

A separate rule covers an online purchase, by internet, the PSE payment button, or a call centre, paid with a card or another electronic instrument. It does not apply to a purchase made in person, or where the seller or the card issuer is outside Colombia. The firms in the payment have 15 business days to reverse a charge the customer says was fraud or was never asked for, if the customer raises it within five business days of learning of it.

When that online purchase is reversed, the card issuer takes the money back from the seller's account. It checks the account once, in the order the notices arrived. If the account cannot cover the whole sum, the reversal is partial and the seller must pay the customer the rest. The customer has five business days from learning of the fraud, an unwanted purchase, or goods that are missing or faulty, to complain to the seller and to tell the issuer. If a court or an authority later rules, in a final decision, that the reversal was not due, the customer bears the costs of having reversed it.

The rule is article 51 of the 2011 consumer statute, and Decree 587 of 2016 sets the steps. It covers fraud, a purchase the person did not ask for, goods that never arrive, and goods that are wrong or faulty. It is for electronic commerce. A transfer the person confirms on Bre-B, after seeing the masked name, is a different movement: the central bank's first-year slides put the maximum time at 20 seconds, and the system runs every day of the year, up to COP 12,110,000 unless the institution sets a lower cap.

Illegal investment schemes the financial supervisor identified were smaller in 2025 than in 2024: at least 245 people and COP 9,306 million, against at least 870 people and about COP 23,690 million. The 2025 schemes were unauthorised investment funds, offers tied to crypto-assets, and supposed productive businesses.

US$20.2m (COP 81.68b) of it was returned to victims, 6.2% of the money lost.

In the 2024 coexistence survey, 66.8% of people who had a digital security incident in 2023 told no competent authority, so 33.2% did. Among those who did not report, the reasons the statistics office prints most often are that they thought it unnecessary, 32.4%, and that the authorities do nothing, 21.0%. A further 19.3% said they did not know the process. For all crimes in the same survey, 30.8% of victims told an authority.

Banks received more than 765,000 fraud claims in 2025, for more than COP 967 billion. The financial supervisor's inclusion report for 2024 recorded 3,073,407 complaints about financial products, 69.3% more than in 2023. Unrecognised transactions were 43.1% of the reasons, 42.2% of complaints started on a digital channel, and 958,884 complaints, 31.2%, were tied to fraud or impersonation. The industry and commerce regulator recorded 40,316 impersonation complaints with its data-protection arm from 2020 to June 2026, and 1,822 telecommunications fraud complaints with its consumer arm in 2025, up from 1,158 in 2022.

Prosecutor files and police complaints sit alongside those claims, and each body keeps its own count. Prosecutors opened 136,667 fraud files in 2025, down from 149,325 in 2024. The police recorded 62,299 complaints in 2025 for the three most common computer offences, 88% of that series. The financial supervisor has added complaint categories for instant payments so that those reports can be picked out earlier.

The figure shown here is fraud cases recorded by the national prosecutor, the Fiscalia General de la Nacion: 136,667 criminal files opened in 2025 for estafa, fraud under article 246 of the Penal Code. It counts fraud of every kind, including fraud against businesses, and only the files the prosecutor actually opened. Of those files, 114,168 were the smaller form of the offence, 15,659 were the ordinary form, and 6,840 were an aggravated form or the larger sum. The 2024 total was 149,325.

A second prosecutor series covers the computer offences in Law 1273 of 2009. In 2025 that series was 92,608 files. Theft by computer means was 50,721, abusive access to a system was 18,728, misuse of personal data was 11,215, fake websites set up to capture personal data were 4,949, and a transfer made by manipulating a system without consent was 4,507. The police cyber centre, in the criminal investigation directorate, counted the same three leading offences as complaints rather than as prosecutor files: 62,299 in 2025, 88% of computer-crime complaints that year.

Law 1273 punishes breaking into a system, blocking one, intercepting data, damaging data, using malicious software, misusing personal data, putting up a fake site to harvest data, and taking money through a computer. Fraud itself remains article 246. By 16 January 2026 the police had logged 764 computer-crime complaints in the new year, 334 of them theft by computer means, with Bogota the city named most often, at 137.

On the prosecutor's fraud count, the smaller form of the offence is the bulk of the files: 114,168 of 136,667 opened in 2025. The ordinary form was 15,659. The remaining 6,840 were an aggravated form or the larger sum. The largest aggravated slices were fraud by leading the person into a mistake, 2,911 files in the smaller band, and fraud tied to an insurance contract or a motor vehicle, 1,732.

On computer crime, theft by computer means is the largest prosecutor file, 50,721 of 92,608 opened in 2025. That is money taken through a system. Next is abusive access, 18,728 files, which is getting into a system without permission, and then misuse of personal data, 11,215. Fake websites built to capture personal data were 4,949 files, and transfers made by manipulating a system, without the account holder's consent, were 4,507. The police complaint count is in the same order: those first three offences were 62,299 complaints and 88% of computer-crime complaints in 2025.

The banks' claims split differently from the criminal files. Debit cards were 51.2% of fraud claims and 16.3% of the amount. Credit cards were 24.9% of claims and 22.3% of the amount. Digital channels were 23.5% of claims and 56.0% of the amount, and internet operations were 83.8% of disputed transactions and 79.6% of the money. In the coexistence survey the leading digital incidents were a hacked email or social account and electronic bank fraud, 33.2% and 32.4% of people who had an incident.

The shared system is Bre-B, which the central bank runs with the industry under a 2023 resolution. It opened on 6 October 2025 with 128 participants, up from 25 institutions on instant payments before that, and by 30 September 2026 it had 245, with 110 million keys and 36 million users with at least one. The financial supervisor watched that rollout for fraud, impersonation and unauthorised access, and added complaint categories for instant payments.

The industry and commerce regulator has fined phone companies COP 2,390 million since 2023 for weak identity checks. The police count computer-crime complaints, and prosecutor fraud files fell by 12,658 in 2025, to 136,667. For every COP 100,000 the banks moved, the amount customers disputed as fraud rose from COP 3.3 in 2016 to COP 7.2 in 2025. Illegal schemes the supervisor identified shrank from at least 870 people and about COP 23,690 million in 2024 to at least 245 people and COP 9,306 million in 2025.

An online card payment the consumer statute treats as fraud comes back from the seller's account. A confirmed instant transfer is checked against a masked name and then moves in at most 20 seconds, at any hour, up to COP 12,110,000. Of people with a digital security incident in 2023, 66.8% told no competent authority. Payments between the networks inside Bre-B grew 14 times and were still under 5% of the value. On 2 October 2026 the central bank published a draft rule to open the system to business and government payments.