{"success":true,"data":{"id":"mx-spei-clabe-redirect-lure","label":"Fake Mexican SPEI CLABE 18-digit account-swap lure — \"CLABE actualización / nueva CLABE interbancaria\" pretext redirecting future SPEI payments to attacker account. SPEI processes ~9M daily transactions. Detection: SPEI / CLABE brand + actualización / redirect narrative. Source: Red-Team R8 multi-agent council C3 (MX payment-rail specialist); CNBV phishing advisory 2025.","description":"Fake Mexican SPEI CLABE 18-digit interbank account-swap lure targeting Mexican businesses and AP staff. The phish narrative arrives in Spanish as: \"Actualización de CLABE: Nuestra CLABE interbancaria ha cambiado al [18-digit CLABE]. Por favor actualice su cuenta para futuros pagos SPEI para evitar rechazo,\" or \"BBVA México: La CLABE de su beneficiario ha sido actualizada — pagos SPEI enviados a la cuenta antigua serán rechazados a partir del [date].\" The attacker provides their own 18-digit CLABE interbancaria and redirects future SPEI payments. SPEI processes ~9M daily transactions; a single swapped CLABE can redirect entire payroll flows. Detection: SPEI / CLABE interbancaria / CLABE / \"transferencia electrónica/SPEI\" / BBVA México / Banamex / Santander México / Banorte brand AND \"actualice CLABE\" / \"nueva CLABE\" / \"CLABE ha cambiado\" / \"cambio de CLABE\" / \"nueva cuenta interbancaria\" / \"pagos SPEI rechazados\" narrative. Source: Red-Team R8 multi-agent council C3 (MX payment-rail specialist); CNBV phishing advisory 2025; BCM fraud bulletin Q1 2026.","tier":"danger","category":"other","isThin":false}}