A regulatory change published in Mexico’s official gazette has introduced a measure that cybersecurity specialists across Latin America describe as a profound setback for digital fraud prevention. Mobile operators must now send SMS messages containing links, warning users that their line will be suspended unless they complete a mandatory registration. The messages replicate the exact architecture of a smishing attack: an unsolicited text, a clickable link, manufactured urgency, and the threat of losing a vital service. For years, public awareness campaigns have taught users to treat such messages as fraudulent; the government is now making them an official communication channel, effectively training millions to override that instinct.

This institutional shift arrives at a moment when digital fraud is already pervasive. The Global Anti-Scam Alliance reports that one in two people worldwide encounters a fraud attempt at least weekly, with annual losses exceeding a trillion dollars. In Latin America, criminals are refining techniques that exploit the same trust dynamics. SIM swapping—where attackers clone a victim’s SIM card to intercept banking verification codes—relies on personal data often harvested from oversharing on social media, a practice Mexican police have explicitly warned against. Meanwhile, the ClickFix method, which tricks users into pasting malicious commands, has surged 500 percent in six months, and sextortion cases in Mexico City are increasingly fuelled by intimate images obtained through deception or hacking.

The psychological manipulation behind these schemes is consistent across regions. Russian banks now flag unusual behaviour—such as large cash withdrawals immediately after a loan or a sudden change of device—yet fraudsters adapt by using two-stage phone calls that first create anxiety, then offer a fake rescue. In Brazil, a man was arrested for extorting his own brother by posing as a gang member, using intimate family details to demand payment. In the United States, a phishing message impersonating Meta Verified threatens account deletion to harvest login credentials, exploiting the same fear of losing access that the Mexican SMS mandate now institutionalises.

Viewed from Moscow, where a pensioner couple recently handed over 27 million roubles to couriers after a fabricated security alert, the convergence of official-looking communications and urgent demands is a proven formula for mass victimisation. The Mexican mandate’s phased enforcement, with daily reminders before deadlines, will test whether public awareness can adapt faster than criminal mimicry. The next factual milestone is the first major deadline for line linking, after which any measurable rise in smishing reports will offer a real-world gauge of the policy’s unintended consequences.