Before you respond, stop and verify

Watch this short video (in Spanish) to learn how to spot a fraudulent text message or call, and what to do before you respond.

Scammers use text messages and phone calls to win your trust, scare you, or rush you. If a message or call pressures you to act right away, stop and verify first.

The Communications Regulation Commission (CRC) has guidance on secure text messages and short codes on its microsite: Who's messaging me?

Your personal data belongs to you

In Colombia, your personal data is protected by law (Ley 1581 de 2012). You have the right to know what data a company holds about you, update it, correct it, and ask for it to be removed.

Never share these through an unexpected call or message:

• Passwords
• Verification codes (OTP, one-time codes)
• Card numbers or bank details
• Copies of your ID document

Legitimate companies don’t ask for your passwords or verification codes by text or phone.

Common types of fraud by text and phone

• Smishing: a text message that tries to get you to tap a link or hand over information. Example: “Your package is on hold. Pay the fee here.”
• Vishing: a phone call that uses lies to get your data. Example: someone says they’re from your bank and asks you to “confirm” a code.
• Spoofing: the caller ID or sender name you see has been faked to look like a company you know. A familiar name on your screen doesn’t guarantee who’s really contacting you.
• Wangiri (Japanese for “one ring and cut”): an automated system calls you and hangs up straight away. If you call back out of curiosity, you can end up on a very expensive premium-rate line.

How scammers manipulate you (social engineering)

Social engineering means tricking people instead of hacking systems. Watch out if someone:

• Rushes you: “Act now or your account will be blocked.”
• Scares you: threats of fines, debts, or legal trouble.
• Offers a prize you never entered for.
• Pretends to be someone you trust: your bank, a public agency, a delivery company, or a relative.
• Asks you to keep it secret.

Warning signs

• A sender or number you weren’t expecting.
• A strange or shortened link.
• A request for personal data, codes, or passwords.
• An urgent payment or a prize you didn’t apply for.
• Spelling mistakes, odd details, or information that doesn’t add up.

One warning sign doesn’t prove it’s fraud. Many companies send real messages about payments, reminders, or offers. A warning sign means you should check before you act.

What to do

1. Stop. Don’t act under pressure.
2. Don’t share data, codes, or money.
3. Don’t open links you’re unsure about.
4. Hang up or close the message.
5. Find the official channel yourself: the company’s official website, app, or the phone number on your card or bill. Don’t use the number or link in the message.
6. Confirm the request through that official channel.

Where to report

If something seems suspicious, or you think you’ve been a victim:

• Your mobile operator: report the suspicious number or message.
• The company being impersonated (your bank, a store, etc.): use its official channels.
• The National Police (CAI Virtual): to report cybercrime.
• The Superintendence of Industry and Commerce (SIC): if you think your personal data was misused.
• The CRC: if a suspicious text came from a short code, email a clear screenshot showing the short code and the message to [email protected]