Juan Antonio Matiz Monroy — Lawyer, Universidad de los Andes · Specialist in Criminal Law, Universidad Sergio Arboleda · Professional licence 294.746 (C.S.J.)
Someone used your name, your documents or your banking information to obtain a loan you never applied for. Or you found a social media profile with your photos and your name contacting people you know. Or your bank alerted you to a transaction you did not make. In Colombia this kind of fraud affects hundreds of people every year, and many discover the impersonation once the damage is done: debts in their name, a damaged credit history, emptied accounts, a reputation in question.
It is worth saying at the outset, because it orients everything that follows: digital identity theft is not a technical problem solved by changing passwords, but an offence with identifiable perpetrators and with legal obligations on the side of the institutions; and because digital evidence degrades and institutions run their own claim deadlines, the useful window to act closes fast. Most victims do not know exactly what to do or whom to approach, and that delay has consequences: every hour without action can widen the financial damage and make redress harder.
If it has already happened, you have concrete rights, legal tools and a route to report it and seek redress. If it has not happened yet, there are preventive measures that reduce your exposure. This article covers both. The route for reporting and the standing of the person who reports are set out in the rights of the victim of a crime; and for the trail the fraud leaves published, in the right to be forgotten in Colombia.
What is digital identity theft?
Digital identity theft happens when a third party uses your name, identity document, personal data or digital information —without your consent— to commit fraud, obtain financial services or damage your assets or reputation.
It can happen in very different ways: from the use of your identity card to apply for a loan, to the creation of fake social media profiles with your photographs; from emptying your bank account through phishing, to cloning your SIM card to intercept the verification codes of your apps. In every case someone is using what is yours without authorisation, and Colombian law defines that conduct as criminal, not as a mere information-security incident.
What distinguishes identity theft from other frauds is that the damage is twofold: the immediate financial damage —money lost, debts in your name— and the long-term reputational damage, with a damaged credit history and records that persist even after the fraud has been reported.
That double effect explains the volume of cases reaching the official channels. The National Police’s Virtual CAI receives and channels reports of computer offences in Colombia and publishes its figures periodically; in the firm’s practice, SIM swapping and banking phishing are the forms that most frequently lead to financial fraud of significant value. That is why the useful response is rarely only technical: it is legal, and it depends on documenting and claiming while the trail still exists.
The commonest forms of identity theft in Colombia
Banking and financial fraud is the costliest form. The perpetrator uses your data to apply for loans, cards or financial products, executes unauthorised transactions from your accounts or gets into your online banking through social engineering. The victim can be left with debts in their name that they know nothing about until they appear at the credit bureaus or until a demand for payment arrives.
SIM swapping, or SIM cloning, works differently: the perpetrator convinces the telecommunications operator that they hold the line and obtains a duplicate SIM. With that duplicate they receive every message —including the one-time verification codes of banking apps— and can empty the accounts while the real holder has no signal. It is the fastest-growing form in Colombia in recent years.
Impersonation on social media consists in creating fake profiles with your name and photographs in order to contact people around you for extortion, fraud or reputational damage. In some cases those profiles are used to extort the victim themselves, threatening to publish compromising information or images.
Fraudulent use of documents means presenting your identity card, genuine or forged, or documents with your data, to contract services, sign leases, carry out notarial transactions or deal with State bodies. It can go unnoticed for months, until the victim receives notice of an obligation or of a contract they never entered into.
Phishing and vishing, finally, are deceptions by email, text message or telephone call aimed at obtaining passwords, card numbers or verification codes. Their sophistication has increased: many of these communications carry genuine bank logos, use spoofed telephone numbers and deploy urgency so that the victim acts without thinking.
That artificial urgency is precisely the fraud’s main tool: “your account is at risk”, “you have a suspicious transaction”, “you need to verify now”. Its purpose is to stop you thinking calmly. It is worth bearing in mind that Colombian banks never ask for full passwords, tokens or codes by telephone, email or message; faced with a communication of that kind, the prudent thing is to hang up and call the institution’s official number directly.
Whatever the form, the underlying pattern repeats: someone carries out defined criminal conduct and, frequently, does so by exploiting a control an institution should have had and did not. It follows that the reaction consists not only in securing devices, but in fixing the evidence while it exists and activating the claims within the deadlines that are running.
The legal framework: which offences are committed
Identity theft and digital fraud are defined in Colombia mainly in Ley 1273 de 2009, which added computer offences to the Criminal Code. Several of those offences usually concur in a single episode of impersonation, and that concurrence is what shapes the strategy of the report.
Where the perpetrator creates websites, web pages or fake profiles to capture personal data, financial data or third-party passwords, the conduct falls under article 269G, which defines website spoofing. If through abusive access to computer systems or through deception they obtain an economic benefit without the holder’s authorisation, article 269J applies, on non-consented transfer of assets, carrying 48 to 120 months in prison and a fine of 200 to 1,500 minimum wages.
Article 269F, breach of personal data, punishes with 48 to 96 months in prison anyone who, without authorisation, obtains, compiles, extracts, sells or discloses personal data, and it is the offence that applies where your data was taken from a database and used to defraud you. And where the perpetrator overcomes computer security measures or impersonates a user in order to take their money, article 269I applies, theft by computer means.
To those is added article 296 of the Criminal Code, on personal falsehood, which punishes anyone who impersonates another or claims a name or capacity with legal effects. Where the perpetrator uses an identity card or an altered document, article 289, falsehood in a private document, and article 291, use of a false public document, also apply.
For the victim, this characterisation is not an academic point. These offences recognise them as a party in the criminal proceeding, give them the right to take part in the investigation, to put in evidence and to seek redress for the damage caused within the proceeding or by civil action.
The practical consequence is that responsibility does not end with whoever carries out the fraud. The Financial Superintendence of Colombia has established that institutions in the sector are obliged to implement adequate security systems to protect their customers. Where the fraud happens through deficiencies in those systems —for example, a SIM swap made possible by insufficient controls at the operator or the bank—, the institution may bear non-contractual civil liability towards the victim.
That route, however, does not operate automatically. Whether it lies depends on establishing the link between the failure of control and the damage, and the burden of proof falls on the claimant. It follows that early documentation of the episode —what failed, when and with what consequence— is as decisive for the financial claim as for the criminal report.
Law 2573 of 2026: protection against reports and demands arising from impersonation
Enacted on 19 May 2026 and in force from 19 November 2026, Law 2573 of 2026 protects a person who, after being impersonated, appears with negative credit reports or demands for payment they did not originate. The statute requires telecommunications operators and financial and credit institutions to adopt protective measures, with two central effects for the victim.
The first operates from the moment of notice. On being informed of the impersonation, the source must add to the record the legend “Víctima de Falsedad Personal” and update the data within the following ten (10) business days, amending Law 1266 of 2008. The second arrives with the judicial decision: once the judicial authorities establish the impersonation —personal falsehood, article 296 of the Criminal Code, and related offences—, the impersonated person is released and disassociated from any associated demand for payment and negative report.
Establishing the impersonation before the judicial authority is therefore the step that activates that protection, and hence the value of a technically well-founded complaint. Taken together, the legal architecture confirms the starting point: there is criminally reprehensible conduct, there are duties enforceable against institutions and there are deadlines running. Changing passwords replaces none of the three.
If it has already happened: what to do in the first hours
In impersonation frauds, time matters more than it seems, and so does the order of the steps. What follows is the sequence usually advised for the first hours.
The first thing is to block accounts and cards. Call the bank and ask for a precautionary block on all your accounts and cards without waiting to understand fully what happened: act first and investigate afterwards. Most banks keep lines open 24 hours a day for this kind of emergency.
Next, if you suspect SIM swapping —your phone lost signal for no apparent reason, or you received messages about changes to your line that you did not request—, contact your mobile operator at once, from another phone, to check the state of the SIM and ask for the duplicate to be blocked.
The next step is to change passwords from a clean device, that is, one that has not been exposed: another phone or a different computer. Start with the email account, which is the control point for almost every other account, and go on to the most critical ones.
Then it is worth requesting your credit reports from DataCrédito and TransUnion to check whether there are loans, cards or services applied for in your name that you do not recognise. You can do this on both providers’ online platforms, and it will give you the picture of the potential damage.
Documenting matters as much as blocking. Take screenshots of unrecognised transactions, suspicious messages, fake profiles or any other evidence of the fraud, and record dates, times and amounts. That documentation is indispensable both for the report and for any claim against the financial institution, and its value falls as records are lost, overwritten or become unavailable.
Finally, consult a lawyer before making statements, especially if the fraud involves significant sums, if you have already received demands for debts you do not recognise, or if the impersonation may have led to legal proceedings against you.
Many people’s instinct is to wait until they fully understand what happened before moving. In digital fraud that delay is usually costly: the financial damage can widen in the hours the reaction takes. Act on what you know now and document the rest; clarity can come later, but the window to limit the damage does not wait.
How to report it and what to expect from the process
A report of identity theft and computer offences can be filed with different authorities, which are not mutually exclusive. The Prosecution Service —at any office or through its online reporting platform— is the main route for starting the criminal investigation. The National Police’s Cyber Centre, which specialises in computer offences, can also take the report and carry out technical tracing aimed at identifying the perpetrator. And where the fraud involves a financial institution, the Financial Superintendence opens a complementary route allowing the claim against the bank to be escalated.
The report should include a detailed description of the facts, with dates, amounts and channels used; the documentary evidence gathered, such as screenshots, bank statements and communications; and identification of the accounts or institutions involved, if you know them.
It is worth anticipating how the process moves. Investigations into computer offences are long and technical: the prosecution has to establish the perpetrator’s identity, which usually requires cooperation from platforms, banks and telecommunications operators, and that can take weeks or months. Early reporting, with well-documented evidence, is the single most decisive factor in moving the investigation along.
In parallel with the report, if the fraud involved a bank, you have the right to file a direct claim. The Financial Superintendence sets deadlines for institutions to respond and, if the response is negative or unsatisfactory, the claim can be escalated to the Superintendence or give rise to an action in non-contractual civil liability. Having a lawyer represent you in that process can be decisive in sustaining the claim and ordering the evidence.
The practical consequence is that the criminal route and the claim route run in parallel and on different clocks. Attending to only one of them usually leaves half the problem open.
Your rights as a victim of identity theft
Colombian law recognises concrete rights for victims of identity theft and digital fraud, and it is worth knowing them before negotiating with any institution.
The first is the right to be recognised as a victim in the criminal proceeding and to receive care, guidance and access to case information (Ley 906 de 2004), which includes knowing the state of the investigation and being notified of relevant decisions. To that is added the right to redress for financial damage, which can be sought within the criminal proceeding through the full-redress proceeding, or through an independent civil action against the perpetrator and, where applicable, against the financial institution whose security deficiencies made the fraud possible.
On the information side, you have the right to have your credit history corrected where the fraud generated loans or reports in your name: financial habeas data (Ley 1266/2008) allows that information to be deleted or corrected, before the credit bureaus and before the institutions that made the reports. The same basis supports the right to ask for the removal of fake profiles created with your identity on social media, invoking habeas data and each platform’s policies.
And there is, finally, the right to hold the financial institution responsible where the fraud was made possible by deficiencies in its security systems, in identity verification or in internal controls. It is the counterpart of the duty the Financial Superintendence imposes on those institutions, and what turns impersonation into a matter of enforceable obligations rather than private misfortune.
All these rights share one condition: they are best exercised while the evidence is fresh and the deadlines are still open. If you have already been a victim of impersonation or suspect you may be, the time between the fraud and the legal action bears on both the investigation and the redress. An initial assessment allows what happened, what rights you have and what steps are a priority in your case to be established; you can request an initial consultation to order that first diagnosis.
Preventive measures: reduce your exposure before it happens
For those who have not been victims but want to reduce their risk, there are sensible measures that require no technical knowledge and that appreciably lower exposure.
The first is to enable two-factor authentication with an authenticator app. A second factor by SMS is vulnerable to SIM swapping, whereas an authenticator app (Google Authenticator, Authy, Microsoft Authenticator) generates the codes on the device itself, independently of the mobile network, and is significantly safer.
Use unique, strong passwords for each account. When one password is compromised, the damage multiplies if that same password has been reused; a password manager (Bitwarden, 1Password) removes the need to memorise dozens of passwords and reduces that risk.
Keep a sceptical stance towards unexpected communications. Banks will never ask you for full passwords, tokens or codes by telephone, email or message; faced with any such communication, hang up or do not reply and contact the institution directly using the official number on the back of your card or the official website.
It is also worth monitoring your credit history periodically, requesting reports from DataCrédito and TransUnion at least once a year to spot credit applications you do not recognise; both platforms offer consultation options with a degree of free periodicity. In the same line, limit the personal information you share online: exact date of birth, identity card number, address, mobile number and the names of close relatives are the data most frequently used in impersonation frauds, and less public information means less exposure.
Finally, you can ask your mobile operator to enable additional controls on any request to change or duplicate the SIM associated with your line. It is a pertinent precaution because SIM swapping has grown significantly in Colombia and because it usually announces itself with signs that go unnoticed:
- your phone loses signal inexplicably;
- you receive confirmation messages about changes to your line that you did not request;
- you cannot make or receive calls although there is coverage.
If you experience any of these signs, contact your operator immediately from another phone and change your banking passwords from a different device. Prevention reduces the probability of fraud, but does not eliminate it; that is why it matters to recognise the signs in time, while it is still possible to fix the evidence and stop funds moving.
From the consultation to representation: the impersonation victim’s route
Discovering that someone used your identity —to open a line of credit, sign a contract or commit a fraud— produces a mixture of urgency and bewilderment. Knowing what to do first, and in what order, makes the difference. Support for a victim of impersonation is structured in four moments, and the initial consultation locates yours.
In the first stage, diagnosis and containment, the initial consultation identifies the offences committed, the institutions involved and the reports or demands already affecting you, so as to prioritise the most urgent steps.
The second corresponds to the report and the applications to institutions: the criminal complaint is structured and applications are made to banks and credit bureaus, including the addition of the legend “Víctima de Falsedad Personal” provided for in Law 2573 of 2026.
The third is representation as a victim during the investigation, which allows the prosecution’s steps to be monitored, notifications to be received and the appropriate measures to be sought.
The fourth and last is redress and clean-up of the reports: once the impersonation is judicially established, the release from the demands and the removal of the associated negative reports are pursued.
All four stages depend on the same thing. The sooner the impersonation is documented and the institutions notified, the greater the possibility of containing the financial damage and stopping further movements. That is why this fraud is approached as what it is —conduct with perpetrators and with duties enforceable against third parties— and not as a security failure fixed on a phone.
Conclusions
Digital identity theft is not a technical problem solved by changing passwords. It is an offence, and several usually concur. They include the computer offences of Law 1273 of 2009 and personal falsehood under article 296 of the Criminal Code. Where the fraud was made possible by insufficient controls, the institution may bear non-contractual civil liability towards the victim. That route requires proving the link between the failure of control and the damage.
That is why the first hours matter: block accounts and cards, check the SIM, change passwords from a clean device and document everything. The criminal report and the claim against the institution run in parallel and on different clocks. Law 2573 of 2026 comes into force on 19 November 2026. Once the impersonation is judicially established, the person is released from the associated demands and negative reports.
The initial consultation is that diagnosis: we identify the offences committed, the institutions involved and the reports or demands already affecting you. On that basis, the firm can structure the criminal complaint and the applications to banks and operators. It can also take on your representation as a victim during the investigation and in the clean-up of the reports.
Frequently asked questions
What people usually ask us
Can I hold the bank responsible if the fraud happened through its platform?
In many cases, yes. The Financial Superintendence requires financial institutions to implement adequate security systems to protect their customers. Where the fraud was made possible by deficiencies in those controls —insufficient identity verification, absence of early alerts, failures in authentication systems—, the institution may bear non-contractual civil liability. That claim can be pursued directly with the bank, with the Financial Superintendence, or by legal action with a lawyer’s support.
What happens to loans taken out in my name without my authorisation?
You have to act on two fronts: report the matter to the Prosecution Service (to start the criminal investigation) and file a formal claim with the financial institution that granted the loan, producing evidence that it was not you who applied. In parallel, ask DataCrédito and TransUnion to correct the negative report in your name. Early reporting and documentation are the most decisive factors in the outcome.
How long does an investigation into computer fraud take in Colombia?
Investigations into computer offences are technically complex: they require information to be requested from digital platforms, banks and telecommunications operators, which in turn have internal processes of their own. The process can take several months. Early reporting, with well-organised evidence, is the most important factor. Being represented by a lawyer who actively follows the case also makes a real difference.
Can I report it even if I do not know who impersonated me?
Yes, and you should. Reporting does not require knowing the perpetrator’s identity: establishing it is precisely one of the aims of the criminal investigation. What matters is documenting the facts as precisely as possible: what happened, when, what sums are involved, what evidence you have and with which institutions the transactions were carried out.
What is SIM swapping and how do I know it happened to me?
SIM swapping happens when someone convinces your operator that they are you and obtains a duplicate of your SIM. With that SIM active in another device, they receive all your messages, including the one-time codes from your banking apps. The warning signs are: your phone suddenly loses signal with no coverage problem; you receive confirmation messages about changes to your line that you did not request; you cannot make or receive calls. If you suspect it, call your operator immediately from another phone and change your banking passwords from a different device.
Can I ask for fake profiles created with my name and photos to be removed?
Yes. All the major platforms (Instagram, Facebook, X, TikTok, LinkedIn) have procedures for reporting and removing profiles that usurp another person’s identity. The process requires you to produce your identity documentation and evidence of the fake profile. In addition, you can invoke habeas data (Ley 1581/2012) by formal application. If the platform does not respond adequately, you can escalate to the SIC or bring a constitutional injunction.
Does the bank’s insurance cover impersonation fraud?
It depends on the product and the specific contract. Some financial products include fraud insurance, but with significant exclusions —for example, where the institution takes the view that the customer handed over the passwords voluntarily, even if through deception. Review the terms of your contract before making a claim. If the bank refuses cover or the direct claim, consult a lawyer to assess whether the decision is legally sustainable.
Legal and bibliographic references
Legislation
Colombia. Constitución Política de Colombia, arts. 15, 29 y 90.
Colombia. Ley 1273 de 2009, «Por medio de la cual se modifica el Código Penal, se crea un nuevo bien jurídico tutelado denominado de la protección de la información y de los datos». Diario Oficial No. 47.223.
Colombia. Ley 1581 de 2012, «Por la cual se dictan disposiciones generales para la protección de datos personales». Diario Oficial No. 48.587.
Colombia. Ley 1266 de 2008, «Por la cual se dictan las disposiciones generales del hábeas data». Diario Oficial No. 47.219.
Colombia. Ley 906 de 2004, Código de Procedimiento Penal, arts. 132-137 (derechos de las víctimas).
Sectoral regulation
SUPERINTENDENCIA FINANCIERA DE COLOMBIA. Circular Básica Jurídica (Circular Externa 029 de 2014), Parte I, Tít. II, Cap. I, sobre requerimientos mínimos de seguridad y calidad en el manejo de la información a través de medios y canales de distribución de productos y servicios.
COMISIÓN DE REGULACIÓN DE COMUNICACIONES (CRC). Regulación sobre portabilidad numérica y prevención del SIM swapping en Colombia. 2023-2024.
Case law
CORTE CONSTITUCIONAL. Sentencia T-020 de 2014. Exp. T-4.033.635 (27, enero, 2014). M.P. Luis Guillermo Guerrero Pérez. Habeas Data y supresión de información en bases de datos.
SUPERINTENDENCIA FINANCIERA. Concepto 2023054321. Responsabilidad de las entidades financieras frente a fraudes por suplantación de identidad en canales digitales.
About the author
Juan Antonio Matiz Monroy — A graduate of the Universidad de los Andes (2017) with a specialisation in Criminal Law from the Universidad Sergio Arboleda (2021), he built a solid command of oral litigation at the Universidad del Rosario and at the Universidad de Salamanca, Spain. He sharpened his rigour in evidential reasoning with CESJUL and the Universidad Externado de Colombia. In parallel he went deeper into asset forfeiture —a field that requires understanding the State’s logic on property with the same rigour with which liberty is defended—. He is currently a candidate for the Master’s in Evidential Reasoning at the Universitat de Girona (Spain) and the Università degli Studi di Genova (Italy). Professional licence 294.746 (C.S.J.).