The Supreme Court of Justice of the Nation (SCJN) is preparing to hear a case that could fundamentally shift how telecommunications providers in Mexico handle user data and identity verification. Justice Loretta Ortiz Ahlf has introduced a project that would allow consumers to sue mobile carriers for moral damages in cases where negligence leads to identity theft.
The case centers on a victim who lost access to her mobile service without warning. According to court records, the loss of signal was a precursor to a coordinated digital attack. Hackers obtained a duplicate SIM card in a different state, effectively hijacking her phone number. Once in control of the line, the attackers bypassed security protocols, drained her bank accounts, and distributed private images from her personal accounts.
Establishing legal accountability for digital security
The telecommunications company involved argued that the user assumed all risks by linking her phone number to various digital platforms. It further claimed that the SIM card replacement was processed against a valid identification and that the victim failed to respond quickly enough to the security breach.
Justice Ortiz’s project rejects these defenses. The proposal asserts that telecommunications companies hold a heightened duty of care regarding personal data. It argues that carriers must implement robust verification mechanisms and cannot remain indifferent to the risks posed by SIM swapping. According to a report by Milenio, the project also criticizes the company for questioning the victim's behavior, labeling the defense strategy as a form of revictimization.
SIM swapping involves criminals obtaining a duplicate SIM card of a victim to intercept SMS-based authorization codes. Because many banks and social media platforms rely on these codes for two-factor authentication, the phone number acts as a master key to a user's digital life. BBVA notes that the loss of phone service is the primary indicator of this type of fraud.
If the SCJN approves the proposal with at least six votes, it will establish a binding precedent for courts across Mexico. This would empower citizens to hold providers legally and financially responsible for lapses in identity verification protocols. The court’s document identifies the case as one of high "interest and transcendence," as it seeks to define the boundaries of digital rights and corporate responsibility in a society increasingly reliant on mobile connectivity. The ruling will mandate a new resolution to the victim’s case, including a calculation for damages that accounts for gender-based impacts.
