New measures against identity theft in Colombia
- Jul 3
- 3 min read
With the enactment of Law 2573 of May 19, 2026, Colombia strengthens the protection mechanisms available to victims of identity theft, particularly in connection with negative reports filed with credit information operators and the collection of debts.
This regulation establishes measures aimed at preventing affected individuals from being unfairly reported to credit bureaus or pursued for debts they never incurred, thereby guaranteeing the protection of their rights vis-à-vis telecommunications operators, financial and credit institutions, as well as other commercial establishments that manage or report such information.
The law seeks to mitigate the harmful effects of identity theft by promoting the timely correction of information and the suspension of improper collections, in order to safeguard citizens' good name, financial reputation, and economic integrity.
It recognizes the main forms of identity theft: digital impersonation (use of data, emails, fake profiles, or social engineering) and physical impersonation (misuse of documents or identity to acquire goods and services), including conduct such as the use of third-party cards, the creation of fake profiles, and the fraudulent procurement of credit and services.
Pursuant to the law, telecommunications operators, financial and credit institutions, and other commercial establishments must:
Rigorously verify the identity of anyone applying for a product or service.
Immediately suspend services acquired fraudulently.
Resolve claims within a maximum of 10 days.
Provide the affected individual with all documentation used in the transaction.
Report the affected individual as a victim of fraud without affecting their credit score.
Suspend collection of the obligation upon being notified by the impersonated person.
The law provides that once the affected individual becomes aware of the identity theft, they must promptly notify the entity where the incident occurred, request the cancellation of the fraudulently acquired product or service, and provide preliminary evidence of the incident, as well as file the corresponding criminal complaint with the competent authorities. In turn, entities are required to activate verification and analysis mechanisms to determine whether fraud occurred within a reasonable period.
In particular, with respect to financial information, the law establishes that victims may request the correction of negative reports arising from the identity theft, which must be verified by the entities within a maximum of ten business days. If the fraud is confirmed, the negative records will be deleted and a special annotation will be added identifying the person as a victim, without affecting their credit history. The law also orders the immediate suspension of debt collection while the verification process is underway, preventing the accrual of interest and additional charges.
The law states that the suspension of collection will remain in place until a final decision is issued by the competent authority. If identity theft is confirmed, the victim will be released from liability and may not be affected again by the same facts; otherwise, collection will resume. It should be noted that if the prosecutor's office closes the case because the perpetrator cannot be identified, but does establish that the crime was committed, this must be certified by that authority so that the victim is released from liability.
Another important point is that the law strengthens entities' capacity to prevent and detect fraud, allowing them to release the user from liability when the identity theft is clear, without requiring a criminal complaint — a measure that directly benefits the victim.
The law requires accessible service channels for receiving complaints and claims and providing guidance to victims, as well as the development of a comprehensive support path for those harmed by this conduct.
Regarding its application, the law establishes a transition period before its entry into force, so that entities can adjust their internal procedures and ensure its proper implementation.
While the enactment of this law requires financial institutions and commercial establishments to exercise greater care when granting financial products and delivering goods, it is equally true that, as users, we must implement our own measures to help mitigate this type of criminal conduct.
Comments