Fraudulent SPEI transfers: what to do in the first 2 hours

SPEI processes transfers in seconds — great for the economy, but also for criminals: once money leaves your account, it can bounce through several intermediary accounts within minutes. The first two hours are critical. This isn't the time to search Google — it's time to execute a clear protocol.

Minute 0–15: contain the damage

1. Call your bank's official number (from card or website) and request immediate blocking of online banking, tokens, and linked cards.
2. Report the specific SPEI transfer: amount, date, time, destination CLABE, and folio if available.
3. If you still have access, try canceling pending operations (rare in SPEI, but check).
4. Don't hang up until you get a report number or service folio.

Minute 15–60: activate recovery route

The issuing bank can initiate a SPEI reversal or alert the receiving bank to freeze funds, but only if the destination hasn't withdrawn them. Provide all evidence: screenshots, SPEI folio, suspicious access history. Meanwhile, visit the nearest branch for high amounts — in-person attention accelerates urgent cases.

• File a report with the Public Prosecutor's Office or online; keep the investigation file.
• Notify CONDUSEF if the bank doesn't respond within reasonable timeframes.
• If it was impersonation fraud (they tricked you into transferring), document WhatsApp conversations, emails, and calls.

Minute 60–120: ensure the bleeding stops

Change email, banking, and linked service passwords from a clean device. Check if new devices were registered, your cell number changed, or beneficiaries activated. Enable alerts for every transaction. If you suspect malware, factory reset your phone before operating again.

SPEI has no 'Ctrl+Z'. The recovery window is measured in minutes, not days.

Common SPEI fraud scenarios

• Unauthorized online banking access after phishing or SIM swap.
• Social engineering: convincing you to transfer to a 'security account'.
• BEC business fraud: fake vendor email with new CLABE.
• Fraudulent purchase asking for SPEI payment outside secure platforms.

Realistic recovery expectations

Recovery isn't always possible. If the criminal withdrew cash or transferred to foreign accounts, options shrink. However, acting quickly significantly improves odds. Banks have agreements to freeze receiving accounts when reported in time. CONDUSEF can mediate if the bank doesn't respond per regulations.

Keep written communication with the bank: folios, executive names, dates of each action. If the amount is significant, consider specialized financial fraud legal advice.

1. Request investigation status in writing every 48 hours.
2. Explicitly ask if an alert was sent to the receiving bank.
3. Keep evidence of unauthorized access to your online banking.

Prevention to avoid reaching this point

Enable two-factor with token app, limit daily transfer amounts, register frequent beneficiaries with additional confirmation, never transfer under phone pressure, and verify CLABE through alternate channels before large vendor payments.

Businesses: response protocol

Define a financial incident response plan: who authorizes blocking, who contacts the bank, who files reports. Drill the protocol once a year. Companies with dual approval and CLABE whitelists drastically reduce impact.

At Devson Labs we design payment controls, automated alerts, and anti-fraud training for treasury teams. Tell us if you process high-volume SPEI and want fewer scares.