TL;DR: Colombia’s Law 2573 shifts new account fraud liability to the institution that approved the account, requires evidence such as biometrics, IP addresses and document checks, and forces refunds or debt erasure when verification is inadequate, according to Feedzai. The burden of proof now sits with the party best placed to stop impersonation, not the customer.
At a glance
What this is: This is a policy analysis of Colombia’s Law 2573, which makes institutions prove they verified identity before opening accounts or approving disputed obligations.
Why it matters: It matters because fraud governance now depends on evidence retention, onboarding assurance and dispute handling that can satisfy regulators, courts and customer challenges.
By the numbers:
- Between 2022 and May 2026, 13,983 claims filed through SIC’s consumer platform were 81% against telcos.
Context
Colombia’s Law 2573 changes impersonation handling from a customer burden to an institutional proof obligation. The core governance problem is not whether fraud exists, but who must prove the legitimacy of the account, transaction or obligation after the fact.
For banks, telcos and merchants, the practical issue is evidence quality across the digital customer lifecycle. The law links onboarding, dispute handling and debt reversal to proof that identity checks were done and can be reconstructed later.
That shift matters to IAM, fraud and onboarding teams because control design now has legal weight. If the institution cannot show what it verified, when it verified it and what signals supported the decision, the customer is no longer the party expected to clear the record.
Key questions
Q: What should institutions do first when they cannot prove a disputed account was opened securely?
A: They should freeze collection activity on the disputed obligation, preserve the onboarding artefacts and compare the approval evidence against the customer’s submitted identity. If the institution cannot reconstruct the decision, the dispute should be handled as an evidence failure, not as a customer challenge to dismiss.
A: Because the issue is not only loss, but proof. The institution must show that identity verification, document validation and approval logic were adequate at the moment of decision, or it carries the legal and financial consequence of that failure.
Q: What breaks when onboarding evidence is not retained for later disputes?
A: The institution cannot defend the approval, cannot answer customer information requests, and cannot distinguish a legitimate customer from an impersonator after the fact. At that point, the control exists only as a belief, not as evidence.
Q: How should banks and merchants handle a fraud flag on a customer record?
A: A fraud flag should trigger step-up verification the next time that person applies, not serve as a hidden negative score that blocks them indefinitely. The purpose is to strengthen future identity checks while keeping the flag from becoming an unchallengeable penalty.
Technical breakdown
Dynamic burden of proof in onboarding
Law 2573 creates a legal inversion common in modern fraud regimes: the entity that made the approval decision must demonstrate the decision was justified. In practical terms, this requires verifiable onboarding evidence, not just a transaction outcome. Identity checks, document validation, biometrics and device or network evidence become part of the approval record. The key technical point is persistence. A score alone is not enough if it cannot be reconstructed later as evidence that the customer was present, identified and matched to the account opening event.
Practical implication: retain decision artefacts that can be replayed in disputes, not just model outputs.
Session behaviour as a fraud control
The article frames identity proofing as a continuous problem rather than a one-time event. That matters because impersonation increasingly uses stolen credentials, synthetic identity fragments or account takeover after initial enrolment. Behavioural signals, device reputation and session context help distinguish the genuine customer from someone merely using valid access. This moves fraud control closer to runtime assurance: the account may exist, but the institution still has to know whether the actor in the session matches the enrolment evidence.
Practical implication: extend identity assurance beyond onboarding into transaction and change-event monitoring.
Evidence-based dispute handling
Law 2573 turns complaints into a controlled evidence workflow. Institutions must compare the disputed obligation against the customer’s submitted identity, share the information used in the approval process, and suspend collection when impersonation is reported. The governance lesson is that dispute handling is now part of the control plane, not a back-office exception. If identity evidence is incomplete, inconsistent or inaccessible, the institution absorbs the outcome rather than shifting the burden back to the consumer.
Practical implication: align complaint workflows with auditable evidence retrieval and immediate collection suspension rules.
Breaches seen in the wild
- Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Dynamic burden of proof is a governance control, not a consumer-rights slogan: Law 2573 moves fraud handling into the same class of controls as identity proofing and lifecycle evidence. The institution that approves the account must be able to defend that approval with artefacts, because the approval itself is now the object of scrutiny. For identity programmes, this is a reminder that evidence retention is part of access governance, not an optional compliance layer.
Continuous trust has become the operational baseline for fraud-resistant onboarding: A bank can recognise a document and still fail to know whether the actor in the session is the real customer. That gap is where modern impersonation thrives, especially when stolen credentials or synthetic identities pass individual checks but fail when signals are combined. Practitioners should treat onboarding and session assurance as one lifecycle, not two disconnected controls.
Fraud governance now depends on provable decisioning, not just good decisions: The law does not only ask whether an institution rejected bad actors. It asks whether the institution can show how it reached a yes or no answer and why that answer should stand up in a dispute. That shifts attention from model accuracy alone to traceability, replayability and regulator-ready evidence.
Continuous adaptive trust is the right named concept for this shift: The article describes a model where trust starts before the account is created and evolves across every login and change event. That is a stronger governance pattern than one-time verification because it ties identity assurance to the full customer lifecycle. The practitioner conclusion is clear: if the control cannot explain itself later, it is incomplete now.
What this signals
Dynamic proof obligations will push identity programmes toward evidence engineering: Teams will need to design approval flows that retain verifiable artefacts, not just scores, so disputes can be answered without manual reconstruction. That changes the role of IAM and fraud controls from detection alone to provable decision support.
Institutional accountability becomes more important than customer blame in fraud programmes. Once the entity that approved the account is expected to justify that approval, onboarding, dispute management and collection handling have to behave like one governed workflow.
Continuous adaptive trust: The article’s most useful concept is a lifecycle view of trust that extends past account creation and into every session. For practitioners, the signal is clear: if session behaviour cannot be tied back to an identity assurance trail, the programme is still too fragmented.
For practitioners
- Build a dispute-ready evidence trail Capture the exact identity proofing artefacts used for each approval, including document checks, biometrics, IP context and decision reasons, so a later challenge can be reconstructed without guesswork.
- Extend assurance beyond account opening Treat login, payee change and loan-request events as part of the same identity assurance lifecycle, with session signals that can invalidate a previously valid enrolment if behaviour changes.
- Suspend collection on impersonation reports Automate immediate collection hold, interest stop and dispute routing when a customer reports impersonation, so the operational response matches the legal obligation.
- Separate negative reports from identity flags Use a fraud flag as a step-up trigger only, not as a hidden negative score input, so the flag drives intensified verification without contaminating future eligibility decisions.
- Map approval evidence to legal retention requirements Define how long onboarding artefacts, review logs and customer-facing disclosures must be kept so the institution can answer information requests and court challenges in the required window.
Key takeaways
- Law 2573 shifts impersonation fraud from customer burden to institutional accountability, which changes how onboarding evidence must be designed and retained.
- The operational challenge is not only stopping bad applicants, but proving that the approval decision was supported by verifiable identity checks.
- Institutions that cannot reconstruct their own verification process will face legal, financial and dispute-handling consequences instead of the customer carrying the loss.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CSA Cloud Controls Matrix set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Identity approval and proof obligations sit at the heart of the article’s governance model. |
| Recommendation — Apply PR.AA-05 to ensure approval decisions are supported by verifiable identity evidence. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article focuses on proving the actor is who they claim to be during account opening and session use. |
| Recommendation — Audit onboarding and session assurance for weak authentication signals that let impersonators through. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | The dispute and approval trail depends on controlled handling of identity evidence and credentials. |
| Recommendation — Use IA-5 to govern the lifecycle of authenticators and the evidence tied to account approval. | ||
| MITRE ATT&CK | TA0006 — Credential Access | The fraud pattern relies on stolen credentials and impersonation rather than pure system compromise. |
| Recommendation — Map impersonation and stolen-credential activity to TA0006 and prioritize detection around credential misuse. | ||
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | The article’s controls span identity proofing, approval, evidence and lifecycle governance in cloud-enabled services. |
| Recommendation — Align IAM governance with approval evidence retention and dispute-ready identity controls. | ||
Key terms
- Burden Of Proof: The burden of proof is the evidentiary standard required to convince stakeholders that a security issue deserves action. In practice, it means showing exploitability, reachability, and impact rather than relying on severity scores or theoretical exposure alone.
- Continuous Adaptive Trust: Continuous adaptive trust is a runtime access model that adjusts permissions as an agent behaves. Access is time-bound, purpose-bound, and context-aware, then reduced or revoked when actions drift from expected intent. It is a stronger fit for agents than static entitlements alone.
- Evidence-Ready Onboarding: An onboarding design that records the specific signals used to approve an account so the organisation can reconstruct the decision later. This includes document checks, identity verification inputs and the contextual data needed to show why the approval was made.
- Step-Up Verification: Step-up verification is a stronger identity check applied when risk increases, such as during password reset, device change, or privileged access request. It uses higher-assurance signals than a static question, such as device possession, authenticated context, or approved administrative review.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org