How Banks in Mexico Use Voice AI for Fraud Alerts and MTU Calls

Banks in Mexico use AI voice agents to call customers as soon as a suspicious card payment or transfer is flagged, and to confirm changes to the customer’s personal transfer limit, the Monto Transaccional del Usuario (MTU). The agent names the bank, asks one clear question, and either confirms the activity or stops it and passes the customer to the fraud team. It never asks for card numbers, NIPs or codes.

Since the MTU arrived in October 2025, banks have a new kind of call to make: confirming that the customer really changed their limit.

This article summarises published regulation and news coverage. It is not legal advice. Confirm current requirements with your compliance team.

What the MTU Changed

According to UnoTV, the CNBV introduced the MTU as a fraud-prevention limit on digital transfers to third parties through SPEI, CoDi, Dimo and other electronic payments:

1 October 2025. Banks had to let customers set their MTU.

1 January 2026. A default limit applied to customers who had not set one, reported as 1,500 UDIS. Check the current default with your compliance team.

Changes need confirmation. Changing the MTU requires double authentication, and the bank confirms the change with the customer through calls, encrypted email or secure notifications.

A fraudster who takes over an account will try to raise the limit first. A confirmation call to the customer catches that.

Calls an AI Voice Agent Can Make

MTU change confirmations. “Did you just raise your transfer limit to 50,000 pesos?”

Suspicious card payments. An unusual amount, merchant or country.

Unusual transfers. A large SPEI transfer to a new account.

New device enrolment. Mobile banking activated on a new phone.

How the Call Works

Step 1. The event triggers a call. The fraud system holds the transfer or change.

Step 2. The agent calls as soon as the event is flagged. It names the bank and the reason.

Step 3. One question. “Was this you?”

Step 4. Act on the answer. “Yes” releases the change. “No” reverses or blocks it, secures the account and transfers the customer to the fraud team.

Step 5. Follow up in writing. A secure notification confirms the outcome and the official contact number.

Protecting Customers From Impersonation

Fraudsters also call pretending to be the bank. Genuine calls should follow rules customers can learn:

Name the bank and the reason.

Never ask for card numbers, CVV, NIP, passwords or codes.

Ask yes-or-no questions about a specific event.

Invite the customer to hang up and call the number on their card.

What a Good MTU Confirmation Call Sounds Like

AI voice agent: Buenas noches, le habla el asistente virtual de su banco. Nunca le pediré su NIP, contraseña ni códigos. ¿Hablo con la señora Torres?

Customer: Sí.

AI voice agent: Hace unos minutos se solicitó aumentar su límite de transferencias a 50,000 pesos. ¿Usted hizo ese cambio?

Customer: No, yo no fui.

AI voice agent: Gracias. Ya mantuvimos su límite anterior y protegimos su cuenta. Le comunico ahora con nuestro equipo de fraudes.

How Local Rules Compare With US and EU Guidance

Buyers often ask how local rules compare with US and EU guidance. These references help.

NIST SP 800-63B. NIST’s US digital identity guidelines class one-time codes sent by SMS or voice call as a “restricted” authenticator, because phone numbers can be hijacked through SIM swaps. They also say biometrics shouldn’t be used alone. A voiceprint can support a check, and it should sit alongside something the customer has, such as an approved device.

PCI SSC guidance on telephone payments. The PCI Security Standards Council’s information supplement on protecting telephone-based payment card data (PCI SSC, 2018) says sensitive authentication data, such as the CVV, must not be stored after authorisation, and that includes call recordings and transcripts.

Common Failure Points

Late calls. A confirmation an hour later may be too late.

Asking for codes. It mirrors the scammer’s script.

Alerts that wait for office hours. Fraud doesn’t follow office hours, so check that the alert process doesn’t either.

Slow handoff. Confirmed fraud needs a person within minutes.

Practical Considerations

AI Rudder has an office in Mexico, runs AI voice agents in 22 markets and has executed more than 80 billion AI calls. AI voice agents can place many calls at the same time, so an alert doesn’t have to wait for a free human agent. AI Rudder is built to meet SOC 2 and ISO 27001, alongside GDPR and PDPA requirements. AI Rudder is named in Tech in Asia’s Singapore’s Top Fintech Companies 2027 list, in the Enterprise Fintech category.

Frequently Asked Questions

Can voice AI handle fraud notifications for banks?
Yes. It calls as soon as the event is flagged, confirms or denies the activity and escalates fraud to a person.

What is the MTU?
The Monto Transaccional del Usuario, a personal limit on digital transfers to third parties, introduced by the CNBV from October 2025.

How are MTU changes confirmed?
Through double authentication, and the bank confirms with the customer through calls, encrypted email or secure notifications.

Should a fraud alert call ask for a code?
No. Genuine bank calls never ask for codes.

Next Step

List the fraud and limit-change events you notify today. Get a Demo and we’ll show you how an AI voice agent would handle them in Mexican Spanish.