Topic starter
21/10/2026 7:00 pm
TL;DR: Law 2573 shifts impersonation fraud liability to the institution that approved the account, because Feedzai says the institution is best placed to stop impersonation. Identity checks now need records that can support the approval decision later.
Editorial analysis by NHI Mgmt Group, based on content published by Feedzai: “Law 2573 and What It Means for Telcos, Banks, and Merchants”.
By the numbers:
- Between 2022 and May 2026, 13,983 claims filed through SIC’s consumer platform were 81% against telcos.
Key questions
A: Because the issue is not only loss, but proof.
Q: What breaks when onboarding evidence is not retained for later disputes?
A: The institution cannot defend the approval, cannot answer customer information requests, and cannot distinguish a legitimate customer from an impersonator after the fact.
Q: What should institutions do first when they cannot prove a disputed account was opened securely?
A: They should freeze collection activity on the disputed obligation, preserve the onboarding artefacts and compare the approval evidence against the customer’s submitted identity.
Practitioner guidance
- Build a dispute-ready evidence trail Capture the exact identity proofing artefacts used for each approval, including document checks, biometrics, IP context and decision reasons, so a later challenge can be reconstructed without guesswork.
- Extend assurance beyond account opening Treat login, payee change and loan-request events as part of the same identity assurance lifecycle, with session signals that can invalidate a previously valid enrolment if behaviour changes.
- Suspend collection on impersonation reports Automate immediate collection hold, interest stop and dispute routing when a customer reports impersonation, so the operational response matches the legal obligation.
Bottom line: Law 2573 shifts impersonation fraud from customer burden to institutional accountability, which changes how onboarding evidence must be designed and retained.
Glossary terms: Burden Of Proof, Continuous Adaptive Trust, Evidence-Ready Onboarding, Step-Up Verification
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
23/10/2026 12:48 am
Dynamic burden of proof is a governance control, not a consumer-rights slogan: Law 2573 moves fraud handling into the same class of controls as identity proofing and lifecycle evidence. The institution that approves the account must be able to defend that approval with artefacts, because the approval itself is now the object of scrutiny. For identity programmes, this is a reminder that evidence retention is part of access governance, not an optional compliance layer.
A question worth separating out:
Q: How should banks and merchants handle a fraud flag on a customer record?
A: A fraud flag should trigger step-up verification the next time that person applies, not serve as a hidden negative score that blocks them indefinitely. The purpose is to strengthen future identity checks while keeping the flag from becoming an unchallengeable penalty.
👉 Read our full editorial: Colombia’s Law 2573 shifts fraud liability to institutions
This post was modified 4 days ago by NHI Mgmt Group