Law 2573 and impersonation fraud: what changes for banks?

TL;DR: Colombia’s Law 2573 shifts new account fraud liability to the institution that approved the account, requires evidence such as biometrics, IP addresses and document checks, and forces refunds or debt erasure when verification is inadequate, according to Feedzai. The burden of proof now sits with the party best placed to stop impersonation, not the customer.

Editorial analysis by NHI Mgmt Group, based on content published by Feedzai: “Law 2573 and What It Means for Telcos, Banks, and Merchants”.

By the numbers:

• Between 2022 and May 2026, 13,983 claims filed through SIC’s consumer platform were 81% against telcos.

Key questions

Q: What should institutions do first when they cannot prove a disputed account was opened securely?

A: They should freeze collection activity on the disputed obligation, preserve the onboarding artefacts and compare the approval evidence against the customer’s submitted identity.

Q: Why does impersonation fraud create a bigger governance problem than a normal chargeback or complaint?

A: Because the issue is not only loss, but proof.

Q: What breaks when onboarding evidence is not retained for later disputes?

A: The institution cannot defend the approval, cannot answer customer information requests, and cannot distinguish a legitimate customer from an impersonator after the fact.

Practitioner guidance

• Build a dispute-ready evidence trail Capture the exact identity proofing artefacts used for each approval, including document checks, biometrics, IP context and decision reasons, so a later challenge can be reconstructed without guesswork.
• Extend assurance beyond account opening Treat login, payee change and loan-request events as part of the same identity assurance lifecycle, with session signals that can invalidate a previously valid enrolment if behaviour changes.
• Suspend collection on impersonation reports Automate immediate collection hold, interest stop and dispute routing when a customer reports impersonation, so the operational response matches the legal obligation.

Bottom line: Law 2573 shifts impersonation fraud from customer burden to institutional accountability, which changes how onboarding evidence must be designed and retained.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →