Taxpayers in Mexico face a heightened risk of identity theft as they prepare for the 2026 annual filing period. Experts warn that criminals are increasingly using stolen taxpayer identification numbers (RFC) to file fraudulent returns or generate fake invoices, leaving unsuspecting victims with potential legal and financial liabilities.
Javier de los Santos Valero, president of the National Fiscal Commission at the Mexican Institute of Public Accountants (IMCP), identified two primary fraud methods. In the first, criminals use a victim’s RFC to issue invoices for fake goods or services provided to real companies. This can falsely brand the victim as an 'EFO'—a company that invoices simulated operations—triggering rapid audits under Article 49 Bis of the Federal Fiscal Code.
'With that RFC, they make me a partner in a company, and with that company, they commit fraud or issue incorrect invoices; I end up in the middle of that situation,' said De los Santos. In the second, more direct scenario, fraudsters use stolen fiscal data to file a tax return before the victim, claiming a tax refund that is then diverted to accounts under their control.
Protecting your fiscal identity
Phishing remains the most common gateway for these crimes. Attackers often pose as the Tax Administration Service (SAT) via email or text messages, requesting sensitive information like the 'e.firma' or CIEC password to 'resolve' fake issues. Once a criminal gains access to these credentials, the SAT system cannot distinguish between the legitimate taxpayer and the impostor.
Santiago Vélez Suberbie, a fiscal specialist, advises taxpayers to actively monitor their status. If a taxpayer discovers unknown income entries, they should verify the RFC of the financial institutions listed on their statement. If the income cannot be reconciled, the taxpayer should exclude those amounts from their return and initiate a formal clarification process.
'My recommendation is to present the declaration and, once it is filed, initiate this review process,' said Vélez. 'If you identify that it was indeed your income, you can file a supplementary return.'
Taxpayers who suspect their identity has been compromised should contact the Taxpayer Defense Office (Prodecon) for free legal assistance. The agency coordinates with institutions like the SAT, the IMSS, and the Infonavit to clear the victim’s record, cancel fraudulent invoices, and halt illegal collections.
Experts emphasize that silence is not an option, as failing to file a return can lead to harsh penalties. To mitigate future risks, authorities recommend changing passwords and the 'e.firma' immediately upon detecting irregularities. Regular check-ins using the SAT’s payroll and invoice viewers through the year are the most effective defenses against becoming a victim of fiscal fraud.
