Addition of article 231 BIS
This article was added to the Penal Code for the Federal District by decree of the Congress of Mexico City and the Head of Government, published in the Official Gazette of Mexico City on Wednesday, July 22, 2026. The new article came into force on Thursday, July 23, 2026.
What does it penalize?
The new criminal offense punishes digital fraud, specifically, the conduct of anyone who creates or uses messages, electronic pages, domains, applications or any other technological interface that pretends to be legitimate, to induce a person to reveal, capture or provide personal, financial or authentication data, with the purpose of obtaining an undue benefit for themselves or for a third party, or to cause harm.
In practice: Impersonating a bank, government agency, or company through a fake website, email, message, or application to obtain passwords, PINs, or bank details from the victim is now a crime in Mexico City.
How is it punished?:
- Prison sentence of 3 to 6 years and a fine of 200 to 600 Units of Measurement and Update (UMA).
- Aggravating circumstance: the penalty is increased by up to half when the victim is a person with a disability or an elderly person, or when the commission of the crime affects a minor.
What changed? (Before and after)
- Before: The Penal Code for the Federal District did not consider digital fraud as an independent criminal offense. The conduct had to be classified under generic fraud (Article 230) or under specific fraud provisions (Article 231), which require proof of both the deception and the resulting financial loss.
- Now With article 231 Bis, the mere obtaining of data through digital fraud is already punished, without the need for a patrimonial fraud to be consummated.
The legislative discussion highlighted that digital transformation permeates commerce, work, education, and social relations, but every technological advance attracts those who seek to exploit it for illicit purposes; digital fraud is one of the most widespread threats to individuals, businesses, and the stability of the capital.
Nationally, the number of attempted cyberattacks dropped from 300 million in 2019 to 120 billion in 2021, increasing the likelihood of becoming a victim by 75%; this equates to one case every 39 seconds, or about 2,200 cases per day.
Where does the new crime apply?
To determine jurisdiction, one should not consider the domicile of the victim or that of the perpetrator who committed the crime, but rather the general rules established by the Penal Code itself:
- Territoriality (Art. 7): The Penal Code applies to common law crimes committed within the territory of Mexico City.
- Extraterritoriality (Art. 8): It also applies to crimes committed in another federal entity when they produce effects in Mexico City, or when they are permanent or continuous and continue to be committed in Mexico City.
- Place of the crime (Art. 11): The crime is understood to have been committed where the elements of its legal description are fulfilled.
In practice: If the victim received the message, accessed the fake site, or revealed their data while in Mexico City, the inducement or data acquisition took place there, and therefore the Attorney General's Office of Mexico City is competent, even if the fraudster is in another state.
The full decree can be reviewed at: Legal Counsel and Legal Services Office of Mexico City. (2026, July 22). Official Gazette of Mexico City, No. 1908. https://data.consejeria.cdmx.gob.mx/portal_old/uploads/gacetas/ea479ed4b3e22bbbb3081b060f74550e.pdf
