Residents across Cancún are reporting a surge of fake banking texts that promise discounts or flag supposed “security issues,” then funnel people to shady links. In local WhatsApp groups, roughly 300 users describe the same pattern: click the link, enter a phone number, and the scam escalates to requests for personal data or a forced app download that can seize the device. One victim was even contacted by callers posing as BBVA staff after a “no-card withdrawal” alert.
The tactic has a name: smishing. Mexico’s financial consumer watchdog explains that criminals send SMS messages that mimic a real bank, baiting you with prizes, blocked accounts, or “suspicious activity” notices. The goal is to lift credentials or trick you into installing malware.
How bank text scams hit Cancún residents
Victims say the messages keep coming from rotating numbers, making simple blocking useless. After the first click, the fake site often mirrors bank branding and nudges you to “verify” data. In some cases, callers follow up, claiming to help while steering targets to install a remote-control app. BBVA’s antifraud guidance matches those red flags and stresses that links demanding updates or “address verification” are hallmarks of ongoing scams.
Banks are blunt about their rules. They do not ask for passwords, one-time codes, or full card details by SMS, chat, or phone. If any message does, it’s a scam. BBVA’s security pages spell this out and advise customers to ignore links and instead open the official app or dial the bank directly.
There’s also timing. Cybersecurity teams warn that fraud spikes around big shopping events, when people expect delivery updates and bank alerts. With El Buen Fin days away, experts anticipate more phishing and smishing waves piggybacking on “failed delivery” notices and “blocked account” claims.
Authorities are urging quick reporting. Mexico’s CERT of the National Guard advises blocking and reporting suspicious numbers and provides the 088 line for victims. Locally, Quintana Roo’s Cyber Police reminds residents not to share banking data over message or email and to avoid opening unknown links.
If you clicked or paid, act fast
If you entered data or installed anything, speed matters. Contact your bank via the official app or the number on your card to freeze compromised products, if needed. Then change passwords used on the phone, starting with email and banking. Banks’ security pages recommend hanging up on any “agent” who requests codes, and returning the call only via official channels. If malware may be present, back up essentials, then perform a clean reset before restoring. Finally, file a report with 088 and notify Quintana Roo’s Cyber Police to aid broader takedown efforts.
Why this matters here is simple. These texts feel routine, almost boring, until they empty a paycheck or take over a phone. Cancún residents are seeing more of them, not fewer, and the messages are getting sharper in their mimicry of real bank language. Treat unexpected links like a broken glass on the sidewalk—step around them every time. Use your bank’s app, not the link in a text. And if a message insists on urgency, that urgency is your cue to slow down.
