Digital fraud in Mexico and user identity verification, Digi Mart USA News (Mexico): Mexico recorded 33.8 million crimes in 2025, and the most frequent was not street robbery but fraud, according to data the National Institute of Statistics and Geography (INEGI) published in September. The figure changes the conversation for any company that moves money online.
Verifying the identity of users has stopped being a compliance formality and has become a central part of the product.
According to the National Survey on Victimization and Perception of Public Security (ENVIPE) 2026 from INEGI, fraud, both banking and consumer fraud, led the list of crimes in 2025, ahead of extortion and street or public transport robbery. Each fraud victim lost an average of 7,551 pesos.
The real figure is likely higher: 93.4% of crimes were not reported or did not result in an investigation file.
Many of these scams begin with a cell phone. As TreceBits has explained in its analysis of calls with the +234 prefix, scammers combine international numbers, urgency and impersonation to obtain personal data.
With that data they open accounts in other people’s names, and at that point the problem shifts from the user to the platform.
Few sectors show better what it means to verify identities under regulatory pressure than gambling with wagers. The Anti-Money Laundering Law (LFPIORPI) places them in section I of Article 17, the first of its list of vulnerable activities.
In addition, the reform to its regulations published in March 2026 expressly mentions digital platforms. The operations of one player are added together, and when they reach 325 times the daily value of the UMA within 24 hours they become subject to the law.
From that point, operators holding permits from the Secretariat of Governance must identify the player and file notices with the authority when legal thresholds are exceeded.
At the end of September 2025, the General Directorate of Games and Raffles counted more than 30 licensed digital operators under the .mx domain. In that channel, verification occurs within minutes and without in-person contact.
Many of these operators do not build their platforms from scratch; they start with white-label casino software, which already includes registration, document validation, deposit limits and transaction monitoring. The model speeds up launch but does not transfer responsibility.
Before the Treasury, through the Financial Intelligence Unit and the SAT, and before the SEGOB, the party held accountable is the permit holder, not its technology provider.
That separation between who builds the tool and who bears the legal risk is the same one facing fintechs, marketplaces and payment apps today.
On July 16, 2025, the reform to the LFPIORPI was published in the Official Gazette of the Federation. Among the changes with the greatest operational impact are:
– A mandatory risk-based approach for all vulnerable activities.
– Lowering the threshold for identifying the controlling beneficiary from more than 50% to more than 25% ownership.
– Retention of records for ten years, double the previous period.
– Mandatory annual training on the subject.
– Automated mechanisms to permanently monitor client operations.
With the regulations now updated, the operational rules are on the table. The practical consequence is clear.
“Knowing the customer” no longer means asking for a photo of the voter ID, but documenting how the risk of each user was assessed and keeping that evidence.
Platforms that best resist fraud usually combine several layers:
1. Validation of official documents against source records, such as the CURP or the voter ID.
2. Biometric liveness testing, to confirm that the person in front of the camera is real and matches the document.
3. Continuous transaction monitoring, not just a review at the time of registration.
4. Adjustable risk rules.
A user who deposits little and operates regularly does not require the same scrutiny as one who suddenly moves large amounts.
No single layer is sufficient on its own. A stolen identification can pass document validation, and a deepfake can fool a weak liveness test.
The defense lies in combining layers and recording each decision.
For many companies, identity verification still appears as an expense. INEGI’s figures suggest a different reading.
In a country where fraud is the most common crime and is rarely reported, a platform that does not screen its users ends up absorbing chargebacks, fake accounts and sanctions. The anti-money-laundering reform only formalized what the market was already charging: in Mexico, knowing who is on the other side of the screen is part of the product.
