The Rails Are Built. The Trust Layer Isn't.

The Infrastructure Won. The Trust Problem Didn't Get Solved.

Latin America has spent the last decade building some of the most advanced payment infrastructure in the world.

Brazil's Pix processes transactions for over 150 million users, 85% of the adult population, at no cost, around the clock, with settlement in under ten seconds. Mexico's SPEI is on track to surpass the combined volume of every card network in the country. Colombia has issued an open finance decree mandating standardized data sharing. Across the region, governments and central banks have built what was, until recently, considered impossible: real-time payment rails accessible to nearly everyone.

And yet, despite all of it, cash still accounts for 58% of personal consumption spending across Mexico, Central America, and the Caribbean. In Jamaica, it's 72%. In Guatemala, 68%. Consumers want to go digital. The infrastructure exists to support them. But adoption has stalled at the last meter, the moment when someone reaches for their phone instead of their wallet.

The conventional explanation is merchant inertia and habit. The deeper explanation is harder: the trust layer underneath the rails was never upgraded. And as adoption scales, the cost of that gap is becoming impossible to ignore.

What the Pix Fraud Numbers Actually Show

Brazil is the clearest case study available because Pix has scaled faster than any payments system in modern history, and the fraud numbers have scaled with it.

Between January and September 2025, Brazil registered 28 million Pix-related fraud cases. The Central Bank's own data puts the fraud rate at just 0.007% of transactions, but at Pix's scale, that small percentage translates to R$2.7 billion in direct Pix scam losses in 2024 alone, a 43% year-over-year increase. Total annual fraud losses across Brazil's digital economy are now estimated at R$297.7 billion, roughly 2.5% of national GDP.

Roughly 70% of those losses come from social engineering, schemes where the victim is manipulated into authorizing the transfer themselves. The fraud doesn't bypass the system. It convinces the user to act inside it.

This is what makes the Pix fraud story so important globally: the system itself is technically sound. The cryptography works. The settlement is fast and final. The Central Bank has rolled out the Special Return Mechanism (MED), device limits, key validation, and is preparing GRAF, a graph-based system designed to trace and freeze fraudulent transfers across multiple account hops. Every layer of operational defense has been hardened.

The losses keep rising anyway. Because the attacker doesn't need to break the rails. They just need to convince a human that the person on the other end of the transaction is who they claim to be.

The Architecture of Misplaced Trust

The pattern repeats everywhere instant payments scale.

Mexico's SPEI is now targeted by social engineering at industrial scale. Colombia's open finance push is creating new attack surfaces around third-party data sharing. Peru's banking regulator has moved to mandate two-factor authentication on every card transaction and shifted liability for unrecognized transactions onto financial institutions. Chile is criminalizing the fraudulent use of payment methods and tightening customer authentication requirements.

These are sensible regulatory responses. But they share a common limitation: they tighten controls at the application and transaction layer while leaving the identity layer underneath largely unchanged.

Account onboarding still relies on document checks that AI can now generate at scale. Authentication still falls back to SMS one-time passwords that can be intercepted via SIM swap. Recovery flows still depend on email and phone numbers, channels that attackers actively target.

The result is a structural mismatch. The payment rails operate at machine speed. The identity layer operates at human speed, with human-readable credentials that humans can be tricked into transferring. As long as that mismatch exists, fraud will scale faster than defenses. Brazil's experience proves it.

Why the Mobile-First Markets Are the Most Exposed

The countries leading global digital payment adoption are also the countries with the most concentrated SIM-based identity exposure.

In LatAm, the phone is the bank, the wallet, the merchant terminal, and the customer service channel — often all in one app. In Brazil, 85% of adults transact through Pix on their phones. In Mexico, mobile is the primary interface for SPEI for tens of millions. In Colombia and Peru, mobile-first banking adoption has outpaced traditional account ownership.

This concentration is what makes the SIM swap and account takeover problem so acute. When everything routes through a phone number, when the phone number is treated as a proxy for identity across banking, payments, government services, and commerce, every successful SIM swap becomes a master key.

The same dynamic applies in Southeast Asia, Sub-Saharan Africa, and other mobile-first regions. Latin America is simply where the consequences are showing up first, because adoption ran ahead, and the fraud economy has had time to industrialize around it.

The Last Meter Problem Is an Identity Problem

The framing in industry coverage is sharp: the rails are built, but changing behavior is a different problem altogether. The 58% cash usage figure across LatAm North isn't a payments rail problem. It's a trust problem. Consumers are willing to go digital — they're just not willing to risk it.

That hesitation isn't irrational. When R$2.7 billion in Pix scams scales 43% in a single year, when 94% of Brazilians encounter scam attempts at least once a month, when fraudsters can socially engineer a SIM swap and drain accounts before a victim notices their phone has dropped to "No Service" — the wallet stays in the pocket for a reason.

Behavioral change at the last meter requires more than awareness campaigns or merchant incentives. It requires consumers to trust that the person they're paying is who they say they are, and that the account they're paying into hasn't been compromised. Right now, neither side of that equation has a reliable answer.

Hardware-Rooted Identity: The Layer the Rails Are Missing

The piece of infrastructure that hasn't been built into modern payment rails is a deterministic, hardware-rooted identity layer that operates at the same speed as the payments themselves.

Every smartphone on the network already contains one: the SIM/eSIM. It's a tamper-resistant secure element that performs cryptographic authentication with the mobile network billions of times per day. It cannot be cloned, ported, or socially engineered. The keys never leave the hardware.

Used directly, through a dedicated channel on the mobile network rather than as a phone-number proxy, the SIM/eSIM provides exactly what instant payment systems are missing: cryptographic proof that the device authorizing a transaction is the same device bound to the account, signed by silicon, transmitted independently of the application layer.

This doesn't replace fraud detection. It doesn't replace MED, GRAF, or transactional risk modeling. It sits underneath them. It removes the single largest source of social engineering risk — the assumption that controlling a phone number proves identity — and replaces it with hardware-rooted, deterministic authentication that scales at the same speed as the payment rails it secures.

The architectural argument is straightforward. If the rails are operating at machine speed but the identity layer is operating at human speed, attackers will continue to exploit the gap. Closing it requires moving identity into the same layer as the rails — into hardware that's already deployed, on networks that already authenticate billions of times a day.

What This Means for the Next Phase

Latin America is the frontline for a problem the rest of the world will face within the decade.

The U.S. is moving toward instant payments through FedNow and the RTP network. India's UPI processes 16 billion transactions a month. The EU is rolling out instant SEPA. Every major economy is on a trajectory toward real-time, mobile-first, account-to-account payments. Every one of them will inherit the same identity layer mismatch unless they choose to address it deliberately.

Brazil's Central Bank, to its credit, has been honest about the limits of operational fraud controls. MED 2.0 and GRAF are world-class responses — but they're recovery and forensic mechanisms, not prevention. Prevention requires moving the trust anchor below the application layer entirely.

The payment rails are built. The next infrastructure project is the identity layer underneath them. The countries and providers that solve it first will set the architecture for the next decade of digital payments.

The Bottom Line

Latin America's payments infrastructure is a global benchmark. The rails work. They're fast, free, accessible, and trusted operationally.

But the identity layer underneath them was never upgraded for the era of instant, irreversible, mobile-first payments. As long as social engineering remains the dominant attack vector, fraud will scale alongside adoption, and the last meter problem will keep cash in consumers' pockets longer than it should be.

Hardware-rooted identity, anchored in the SIM/eSIM and delivered through a dedicated channel on the mobile network, is the architectural upgrade the rails are missing. The hardware is already deployed. The infrastructure is already operational. The only thing missing is the decision to use it.

The rails won. The trust problem hasn't been solved. That's where the next phase begins.

Building payments infrastructure for emerging markets? See how hardware-rooted identity closes the trust gap →