The Architecture of Financial eCrime in LATAM: Limits of Traditional Defensive Models

AUDIENCE · CISOs, Risk Directors, Heads of Fraud and technology decision-makers at LATAM banks and fintechs.

Executive summary

My thesis is specific: in the cases documented here, a defense focused mainly on initial access leaves critical questions unanswered when risk continues in the session, in the identities that enable institutional processes, and in the recipient or subsequent movement of funds.

I do not argue that authentication, the perimeter, EDR, WAF or antifraud engines have stopped being useful. Nor do I claim that all Latin American banks share the same gaps. I make a narrower argument: the sources reviewed show coverage limits when useful controls are observed in isolation and the trust decision ends at login or at the initial authorization of an operation.

The three dimensions of this whitepaper —session, identity and movement of funds— are an analytical framework I propose from distinct evidence. They do not constitute a single demonstrated operational chain, nor do they prove that the same actor moved through all three.

1. Session: authentication does not exhaust the trust decision

On August 25, 2026, Group-IB documented Balonx Sistema, a PhaaS platform targeting Mexican financial institutions. The research describes a persistent WebSocket connection between the phishing page and the operator panel, real-time bidirectional interaction, capture of information entered by the victim and dynamic screen changes. When the victim submits credentials, the operator can relay them to the legitimate portal, receive the MFA request and display a screen to capture the OTP before it expires. Group-IB, Balonx Sistema, 25-08-2026

The source describes that architecture as real-time session control and as a man-in-the-middle operation. That does not demonstrate that Balonx necessarily uses a reverse proxy or steals session cookies in every flow. What I treat as demonstrated for this analysis is the mechanism Group-IB describes: persistent WebSocket, real-time interaction, credential/OTP capture and dynamic manipulation of the victim experience. The documented case is limited to Mexico; I do not use it to claim either presence or absence of this mechanism in other LATAM countries. Group-IB, “Mecánica del ataque” section

NIST SP 800-63B-4 states in §3.2.5 that authenticators requiring manual entry of an output —such as OTP or other out-of-band mechanisms— are not considered phishing-resistant because that output is not cryptographically bound to the specific session being authenticated. NIST recognizes cryptographic mechanisms with channel binding or verifier-name binding as forms of phishing resistance. That scope is authentication: by itself it does not imply payment authorization, transaction-fraud detection or immunity from every form of session theft. NIST SP 800-63B-4, §3.2.5

My conclusion for this dimension: defensive architecture needs to be able to relate authentication, session continuity, device and operation. A successful login is an important signal, not a sufficient guarantee about everything that follows.

2. Identity and institutional infrastructure

The second dimension appears when risk is no longer limited to the customer device or credentials and reaches the access paths that make it possible to operate financial environments.

CrowdStrike publicly describes SLIM SPIDER as an eCrime adversary that has targeted Brazilian financial institutions since at least March 2026 and demonstrates operational knowledge of Brazil's financial infrastructure, including Pix, digital-asset platforms and cloud environments used by financial entities. That public profile does not by itself demonstrate the specific mechanism used to compromise privileged identities or intrusion details that are not exposed in the public source used here. CrowdStrike, Slim Spider Adversary Profile

Separately, the CrowdStrike 2026 Threat Hunting Report reflects active investigations conducted from July 1, 2025 to June 30, 2026 and describes, at a global level, the abuse of legitimate authentication flows to turn a compromised identity into rapid access to SaaS and cloud environments. I do not attribute that global pattern to SLIM SPIDER; I use it as separate evidence that an authenticated identity can become an access path into institutional environments. CrowdStrike, 2026 Threat Hunting Report

My conclusion for this dimension: a financial-defense strategy should not limit its question to “is the customer's device protected?”. It also needs to know which human and non-human identities can access critical financial processes, with which privileges, which secrets or credentials enable them, and which signals can reveal abuse of those access paths.

3. Recipient and movement of funds: the transaction does not end with the sender

The third dimension does not necessarily begin after money has left. Recipient risk can be assessed before a transfer, and subsequent movement can provide additional signals once the operation begins. I therefore treat the beneficiary and movement of funds as one surface of analysis, not as an inevitable chronology.

In April 2026, BioCatch published results based on data from 36 Latin American financial institutions that together serve more than 300 million customers. In that sample, fraud attempts using remote-access tools increased more than five times over the previous year, and reported money-mule accounts increased 42% regionally. These are proprietary data from BioCatch customers; they are not a census of all institutions, users or fraud in Latin America. BioCatch, 2026 Digital Banking Fraud Trends in Latin America

To explain why time may matter on the receiving side, I use a reference outside LATAM with an explicit scope. RUSI published Following the Fraud: The Role of Money Mules, based among other sources on transactional data provided by Lloyds Bank for known money-mule accounts in the United Kingdom. In that sample, about 28% of received value left within the first 15 minutes; an additional 25% left within the first hour, and less than 15% remained after 24 hours. The source's own scope requires these figures to be read as evidence from a British sample at a single institution, not as LATAM metrics or universal thresholds. RUSI, Following the Fraud: The Role of Money Mules

My conclusion for this dimension: in addition to evaluating the sender, it is useful to be able to analyze the beneficiary, its relationships and the timing of subsequent movements. None of those signals, on its own, proves that a person is a money mule or that a transaction is fraudulent.

4. Where I find the limits of traditional defensive models

The previous cases do not demonstrate the failure of an entire class of controls. Based on these cases, I propose assessing which areas may remain uncovered when controls are considered in isolation.

Balonx documents an operation capable of working inside the authentication and victim-interaction flow. NIST explains why manual OTP entry does not provide cryptographic phishing resistance. The public SLIM SPIDER profile establishes an eCrime case centered on Brazilian financial institutions and their financial/cloud environments. CrowdStrike's Threat Hunting Report separately documents global abuse of authenticated identities into SaaS/cloud. BioCatch contributes regional signals from its own customer base on remote access and money-mule accounts. RUSI contributes British evidence from one institution on the speed at which funds leave known mule accounts. Group-IB · NIST · CrowdStrike SLIM SPIDER · CrowdStrike 2026 Threat Hunting Report · BioCatch · RUSI

I do not derive a demonstrated “common chain” from that evidence. I derive a defensive synthesis of my own: an institution should be able to answer, separately and together, three questions:

1. Session: what evidence shows that the session remains trustworthy after authentication?
2. Identity: which people, accounts, services or secrets can operate critical financial processes, and with which privileges?
3. Recipient and funds: what risk does the beneficiary present, and what happens to the money once the operation has begun?

That is the meaning of the session, identity and movement of funds framework. It does not describe a mandatory adversary sequence; it describes three surfaces that should not remain disconnected in defense.

5. Governance and budget: turning the thesis into measurable questions

I do not propose universal budget percentages. I do not have a sample that would support the claim that every institution should invest the same share in each capability.

Instead, I propose that each institution compare its current investment against measurable questions about its own operation:

Session. What percentage of high-risk operations can be linked to authentication, device, session continuity and context changes? Which signals exist after login, and who can act on them?

Identity. Which human and non-human accounts have access to critical financial processes? Which privileges do they retain, for how long, and under which review, rotation and traceability mechanisms?

Recipient and funds. Which information exists about the beneficiary before a transfer is authorized? Can the institution relate receiving accounts, recurrence, movement speed and signals shared with other areas or entities where regulation permits?

Intelligence. Which concrete decision does each feed, report or IOC support? Which period and population does it cover? Which part is confirmed with first-party telemetry, and which uncertainty remains?

My budget recommendation, therefore, is not to “move X% from the perimeter to another tool.” It is to identify where the organization's visibility ends today and fund the gaps demonstrated by its own evidence, without removing controls that continue to provide value.

6. Conclusion

My thesis is not that traditional defensive models have stopped working. It is that their scope becomes insufficient when trust is evaluated at a single point and the rest of the operation remains fragmented across teams and controls.

In the sources documented here, the problem appears in different dimensions: Balonx operates on the authentication interaction; SLIM SPIDER places eCrime against Brazilian financial infrastructure and cloud environments; CrowdStrike's Threat Hunting Report separately demonstrates global abuse of authenticated identities into SaaS/cloud; BioCatch documents, within its own Latin American sample, signals related to remote access and money-mule accounts; and RUSI contributes British evidence on how quickly funds left known mule accounts in a Lloyds Bank sample.

Those sources do not prove one actor, one campaign or one attack chain. Integrating session, identity and movement of funds is my proposed defensive-analysis framework, built from problems that today are often separated among cybersecurity, identity, fraud, AML, risk and operations.

Initial access remains important. The thesis of this whitepaper is that the defensive decision should not end there.

Sources

• Group-IB — Balonx Sistema: El Rostro Detrás del PhaaS que Impacta la Banca Mexicana — 25-08-2026 — https://www.group-ib.com/blog/balonx-sistema-mexico-phaas-es/
• NIST — SP 800-63B-4: Digital Identity Guidelines: Authentication and Authenticator Management — final 31-07-2025 — https://pages.nist.gov/800-63-4/sp800-63b.html
• CrowdStrike — Slim Spider Adversary Profile — https://www.crowdstrike.com/en-us/adversaries/slim-spider/
• CrowdStrike — 2026 Threat Hunting Report — investigation period 01-07-2025 to 30-06-2026 — https://www.crowdstrike.com/en-us/resources/reports/threat-hunting-report/
• BioCatch — 2026 Digital Banking Fraud Trends in Latin America — 2026 — https://www.biocatch.com/report-2026-digital-banking-fraud-trends-in-latin-america-es
• RUSI — Kathryn Westmore and Allison Owen, Following the Fraud: The Role of Money Mules — web 14-08-2025; PDF July 2025 — https://www.rusi.org/explore-our-research/publications/emerging-insights/following-fraud-role-money-mules