The Digital Economy Law for Digital and Electronic Payments took effect on November 5, 2026, and enables point-of-sale terminals to accept payments via QR codes, a piece of infrastructure that security specialists identify as a new channel for identity impersonation at small and medium-sized businesses.
The decree was published in the evening edition of the Diario Oficial de la Federación on November 4, according to El Economista. Article 13 empowers the Secretaría de Hacienda y Crédito Público to determine the strategic sectors and relevant activities where digital means may be the only form of payment collection, and the third transitional provision sets 15 business days to publish that list. After that, the authorities in each sector will have another 15 business days to issue rules, requirements and gradual transition deadlines. The law recognizes the CURP Digital as identification for contracting financial services and preserves cash or checks when a contingency prevents digital collection.
Kaspersky documented an average of 312,000 blocked phishing attempts every day in Mexico, the second-highest volume in Latin America behind Brazil, with 114 million attempts in a year, according to data reported by Expansión. The firm also blocked 189,000 attempted trojan attacks between September 2025 and September 2026, 70% more than in the previous period, and 372,000 ransomware attempts, 57% more. Retail and wholesale trade accounted for 15.01% of detections by sector. María Isabel Manjarrez, a security researcher at the firm, said that "Esta aplicación tiene que ser segura" when discussing the moment a business adopts a platform. INEGI's 2024 Economic Censuses show the starting gap: 23.5% of micro-businesses used the internet, compared with 82.1% of small businesses and 90.9% of medium-sized ones.
The next piece is secondary regulation: the list of sectors that Hacienda prepares and the rules that Banco de México issues so that terminals accept QR. Both instruments determine which businesses enter the new payment standard first and under what data protection obligations.
This article was written with the assistance of artificial intelligence from verified sources and reviewed by a human editor before publication.