Card cloning and unrecognized charges: what to do in Mexico

Opening your statement and finding charges you don't remember is distressing. In Mexico, unrecognized charges can come from card cloning at ATMs or POS terminals, data leaks at online merchants, hidden subscriptions, or malware capturing your card data. The good news: if you act quickly and follow the correct process, you can often reverse the charge or recover your money.

How card cloning and fraud happen

Traditional skimming installs a device on ATMs or card readers that copies the magnetic stripe and sometimes captures the PIN with a hidden camera. With that data, duplicate cards are made for withdrawals and in-person purchases. In e-commerce, criminals use card numbers leaked from breaches or bought on underground markets.

• ATM skimming: check the slot for attachments and cover the keypad when entering your PIN.
• CNP (Card Not Present) fraud: online purchases without physical card, hard to detect until charged.
• Trap subscriptions: trial periods that become recurring charges in fine print.
• Duplicate merchants: charges with generic names like 'DIG SERV' or 'PAYPAL *' that confuse.

First steps when you spot a suspicious charge

1. Block the card immediately from the bank app or by calling the official number.
2. Document date, amount, merchant, and time of each unrecognized charge (screenshots).
3. File a formal dispute with the bank within the contract deadline (usually 90 days, but act within 48 hours).
4. If there was an ATM withdrawal, check if it matches a place where you recently used the card.
5. Change PIN and request card replacement with a new number.

Your rights as a cardholder in Mexico

Financial services transparency laws and CONDUSEF provisions establish you're not liable for unauthorized charges if you report promptly and didn't act with gross negligence (e.g., sharing your PIN). The bank must investigate and, if fraud is confirmed, refund. The process may take weeks, but early documentation strengthens your case.

A $500 charge you don't report today can become a chain of charges tomorrow. Blocking and disputing takes minutes; recovering without a report takes months.

Prevention: beyond 'watch your card'

Use virtual cards for online purchases with low limits, enable push alerts for every charge, prefer chip/NFC over magnetic stripe, avoid ATMs in low-traffic areas, and review transactions weekly even if you didn't make major purchases.

Difference between fraud and commercial dispute

Not every unknown charge is cloning. Sometimes you forgot a subscription, deferred hotel charge, or purchase by authorized family member. Before declaring fraud, check if the merchant matches a service you signed up for. If you recognize the merchant but not the amount, it may be commercial dispute (contact merchant) not banking fraud.

When it's clear fraud — charges in another state, ATM withdrawals where you weren't, online purchases on sites you never visited — act as emergency. Each hour of delay reduces recovery probability and increases total stolen amount.

• Review active subscriptions on App Store, Google Play, and streaming services.
• Confirm with family if they used additional cards linked to your account.
• Enable geographic blocking if your bank offers it for international purchases.

Businesses with corporate cards

Corporate cards concentrate travel, software, and vendor expenses. Set per-card limits, require receipts for unusual charges, and use platforms allowing disposable virtual cards per vendor.

At Devson Labs we help companies monitor transactions, integrate automatic alerts, and train finance teams. Write to us if you want to reduce corporate card fraud risk.