WHEN THE FINANCIAL SYSTEM TURNS THE VICTIM INTO THE SUSPECT

César Paz-y-MiñoAn Ordinary Citizen

There are moments when one discovers that the real problem is not merely having been the victim of a crime, but what comes afterward: entering an institutional machinery that sometimes seems designed to wear you down.

My story began with a series of international transactions that I never authorized. They were carried out within minutes, from Ghana and Nigeria, while I was in Ecuador and still had my physical card in my possession.

The amount exceeded seventeen thousand dollars. I did not hand over my card. I did not travel to those countries. I did not purchase those products. I did not authorize those transactions.

And yet, from that moment on, something almost as disturbing as the fraud itself began: I had to prove that I was not the criminal.

I immediately called the bank. I requested that the card be blocked. I reported the transactions. I saved messages, emails, and timestamps. I reconstructed phone calls. I filed formal complaints.

One would imagine that, faced with such an anomalous sequence of events, the institution’s first question would be: How did the criminals manage to breach the security mechanisms?

But too often, the question seems to be reversed: Are you sure you did not authorize the transactions? Are you sure you did not share your credentials? Are you sure you did not make a mistake?

The victim suddenly finds himself having to mount a defense. And that is profoundly disturbing.

Because one is not asking for a favor. One is reporting a crime. A fraud that crossed multiple security barriers. We are not talking about an accidental purchase or a card left behind in a restaurant. We are talking about high-value international transactions carried out in rapid succession from West Africa, in countries with which the cardholder had no commercial relationship whatsoever.

For those transactions to be completed, security mechanisms supposedly designed precisely to prevent this kind of event had to be overcome.

That raises uncomfortable questions: How did the criminals obtain the necessary information? How did they bypass the authentication mechanisms? Why were such atypical transactions allowed to go through? Why did fraud-prevention systems fail to immediately stop a sequence of high-value international purchases? Was this solely an external security breach, or were there also internal security failures? Did anyone have privileged access to sensitive information?

I am not claiming that there were accomplices within these institutions. That would have to be established through a proper technical investigation. But when criminals thousands of kilometers away manage to bypass multiple security barriers and generate losses amounting to thousands of dollars, asking whether internal failures or unauthorized access may have occurred is not conspiracy thinking. It is a basic requirement of sound security practice.

The response cannot simply consist of scrutinizing the customer as though he were the primary suspect.

Then Came the Bank

The case eventually reached the financial regulatory authority. After months of submissions, explanations, and documentation, an administrative ruling was issued recognizing that a substantial portion of the transactions was fraudulent and ordering the bank to reimburse more than twelve thousand dollars.

Yet one practical question has remained with me: if fraud has been established, why should I have to pay any part of it?

Exhausted by the process, I ultimately decided to pay the amount deemed my responsibility, in accordance with the ruling issued by the competent authority.

One might think that this would have ended the central dispute.

It did not.

The threatening calls demanding payment continued. I repeatedly had to return to the bank simply to ask for something astonishingly basic: that it correctly apply the regulatory authority’s decision and tell me exactly how much I owed.

One meeting. Two. Three. Four.

I was not asking the bank to erase a legitimate debt. I was trying to pay it. Yet the bank continued to “analyze” the amount.

It is still analyzing it.

Then an additional charge of nearly three thousand dollars appeared, under a category related to revolving deferred payments. A bill for late-payment interest also appeared, despite the ruling issued by the Superintendency.

So the question arises again: Where does this money come from? Is it principal? Interest? Late fees? Financing generated on amounts that were under dispute? Does it include financial consequences arising from the fraudulent transactions themselves?

When a citizen asks where a charge of several thousand dollars comes from, the answer should be immediate, documented, and understandable.

It should not require yet another administrative pilgrimage.

And Then Came the Insurance Company

At the same time, there was an insurance policy associated with the card. For fifteen years, charges related to that insurance had been collected.

When the fraud occurred, I naturally turned to the insurer.

That was when I discovered another reality.

The coverage invoked by the company protected against certain traditional forms of card loss, theft, or counterfeiting. But the insurer maintained that the fraud in my case was not covered because the transactions had been carried out without the physical card being present.

In other words, a citizen can pay for financial protection for years only to discover, when that protection is finally needed, that one of the major forms of modern financial fraud falls outside the coverage, according to the insurer.

The insurance company was commercially linked to the product offered through the bank. Bank and insurer therefore shared a contractual and operational relationship surrounding that insurance product.

At that point, it became difficult to avoid a troubling impression: each institution seemed to possess documents and arguments protecting its own position, allowing it to collect money while avoiding payment, while the citizen was forced to struggle for access to contractual information that should have been transparent from the beginning.

Who exactly contracted the insurance? Which policy was in force? What document was provided to the customer? What were the exclusions? When were they communicated? Where is the evidence showing that the insured person was informed of and understood those limitations?

Different policy and certificate numbers even appeared in the case file. The citizen therefore ends up trying to decipher the documentary architecture of a financial product he never designed.

That is absurd. And it is abusive.

If an insurance company collects premiums for years and later denies a claim on the basis of an exclusion, it should have the elementary obligation to demonstrate, through a small number of clear and unambiguous documents, exactly what coverage was in force and when its limitations were communicated to the customer.

Bank and Insurer: An Obvious Imbalance

Here lies one of the most troubling aspects of the entire experience.

The consumer faces institutions that maintain commercial relationships with one another, share financial products, exchange documentation, and have legal, technical, and administrative departments at their disposal.

On the other side stands one person.

That imbalance does not necessarily imply unlawful collusion. But it does create a structurally dangerous situation: the institutions possess the information, contracts, recordings, computer records, and specialists required to interpret all of it.

The victim has his word, his account statements, and his patience.

And sometimes he does not even receive, in a timely manner, all the documents necessary to defend himself. Sometimes those documents are simply denied. Powerful institutions can shield themselves behind their own bureaucracy.

When access to information is delayed, fragmented, or made unnecessarily complicated, the right to challenge an institution gradually becomes an endurance test.

The Perfect Suspect: The Customer

Perhaps the most infuriating aspect of these procedures is the silent transformation of the victim.

You report that you have been robbed.

Yet you end up having to explain why you were not the person who carried out the transactions.

You must prove that you did not share your passwords. That you did not travel. That you retained possession of your card. That you called in time. That you filed the complaint correctly. That you are not trying to profit from the situation. That you are not attempting to deceive the insurer.

Little by little, you begin to feel that you are being required to prove your innocence.

That completely reverses the most elementary meaning of justice.

I did not commit the crime. I did not make purchases in Ghana. I did not make purchases in Nigeria. I did not authorize those transactions. I did not receive the goods, nor did I benefit from them.

Yet for months, I had to devote time and energy to convincing institutions of something as basic as that.

Meanwhile, the people who committed the fraud remain unknown.

The criminal disappeared.

The victim became trapped in the case file.

We Need to Start Asking Different Questions

Ecuador, like many countries, is experiencing a rapid transformation in financial crime.

Criminals no longer need to steal a wallet. They can operate from another continent. They can obtain data, impersonate identities, circumvent authentication systems, and execute transactions within seconds.

That is why it is no longer sufficient to place almost the entire burden of prevention on the customer.

“Protect your password.”

“Do not share your security code.”

“Check your transactions.”

Of course citizens should do all of those things.

But we must also ask: What did the bank do? Which detection mechanisms worked, and which failed? How were extraordinarily anomalous transactions authorized? Who had access to the compromised information? Was the possibility of a data breach technically investigated? Was improper internal access ruled out through documented evidence? Did the insurance company genuinely explain what it was selling? Did the regulatory authority require the institutions to provide all the information necessary for the citizen to defend himself?

These questions do not attack the financial system.

They strengthen it.

Because a system that takes offense when citizens ask how their money disappeared is a system that still does not understand the meaning of trust.

Exhaustion as a Defense Mechanism

After this experience, I have reached an uncomfortable conclusion.

Large institutions possess something that ordinary citizens do not always have: time.

A bank can wait. An insurance company can wait. A legal department can issue another memorandum. A case file can remain open indefinitely.

A person, however, has work, family, problems, illnesses, responsibilities, and a life that must continue.

That is why exhaustion can become, even without anyone deliberately designing it that way, an extraordinarily effective mechanism against legitimate claims.

Many people will simply give up.

They will pay. They will sign. They will accept an incomplete explanation.

Not necessarily because the institution is right, but because continuing the fight costs too much.

That is precisely what should never happen.

I Am Not Asking for Privileges

After months of procedures, my position is very simple.

I want to pay what I legitimately owe. I do not want the bank to lose money that rightfully belongs to it. Nor do I expect an insurance company to pay a claim it is not legally required to cover.

But neither will I accept being charged for losses generated by criminals, interest arising from transactions I did not make, or contractual exclusions whose proper disclosure has never been demonstrated.

I am not asking these institutions for solidarity.

I am asking for accountability.

Above all, I am asking for something that should be obvious: when a person reports fraud, the system should investigate the fraud before turning the person reporting it into a suspect.

Because something is profoundly wrong when criminals thousands of kilometers away can breach financial security mechanisms within minutes, while the person who spends months answering questions, submitting documents, attending meetings, and justifying himself is the victim.

The problem is no longer merely how much money disappeared.

The deeper problem is what kind of system we are building when it becomes harder for an honest citizen to prove that he was a victim than it is for a criminal to disappear with his money.

If this has happened to you, keep fighting.

This is a true story. It is my story. Do not let financial power win.

.