Callstrike
Compliance

Voice phishing simulations in Mexico

Phone numbers in MexicoProvisioned by Callstrike after approval

Mexico replaced its data protection statute outright in March 2025 and dissolved the authority that used to enforce the old one, so a voice phishing simulation here is planned against a law barely a year old. Numbers are cleared once and then assigned to your workspace. The decision that shapes everything else is whether anything happens to an individual who fails, because that is what pulls in a workplace rulebook drafted jointly with your workers and published for anyone to read.

Phone numbers

Supplied by Callstrike

Local numbers in Mexico, after a one-time approval.

Running a simulation

Permitted, on the relationship

No balancing ground exists. The route is the obligations the employment relationship creates.

Consent

Tacit by default, so it is the notice

Agreement is tacit where the privacy notice reached the person and they did not object.

Getting a phone number in Mexico

One approval per country, completed in the console.

Provisioned by Callstrike after approval

Numbers here are not released from open inventory. Your workspace is cleared for this country once, and Callstrike then provisions a dedicated number against it for your simulations. Approval is a one-time, per-country step and usually takes 3 to 5 business days. We only ask for what the regulator requires.

Mexican numbers are not released from open inventory, so your administrator clears the country once in the console and Callstrike then provisions a dedicated Mexican number against that clearance. The form is short. Your business name is typed in, and then two things are evidenced: that the name is yours, and that you have an address. Those are the two lines of the table below, and the tax status certificate does double duty because it is accepted for each.

That certificate is worth starting early even though nothing else here is slow. It is issued by the tax administration through its own portal, so the person who can produce it quickly usually sits in finance rather than in security. The address it evidences has to fall inside the locality or region covered by the number's own prefix and a post office box will not do, which means the prefix you want and the address you can prove are one decision rather than two.

  1. 01Complete the regulatory clearance formYour administrator, in the Callstrike console. The form asks only for what the regulator requires.
  2. 02Approval is granted against your workspaceTypically three to five business days, and once only for as long as you operate here.
  3. 03A dedicated number in Mexico is assigned to youCallstrike
  4. 04Build and launch the campaignYour team
What you provideAccepted evidence, any one of
Proof of business nameThe Constancia de Situación Fiscal (Tax Status Certificate) can be obtained through the SAT portal.Constancia de situación fiscal
Proof of business addressMust be within locality or region covered by the phone number's prefix; a PO Box is not acceptable.Constancia de situación fiscal, Utility bill, Government communication

These requirements are set by the carrier and can change. The form in the console is generated from their current rules, so treat it as authoritative and this table as a summary of what to have ready. Checked 2026-09-07.

Is it lawful to run a simulation in Mexico?

The position in short, before your counsel reads the detail below.

Yes, and the first thing to get right is which statute you are reading. One decree published in March 2025 enacted an entirely new federal data protection law for the private sector, abrogated the 2010 statute it replaced and took effect the following day, and the same wave of reform dissolved the national institute that enforced it and moved its functions to a ministry. Any Mexican guidance built on the old article numbers is describing a repealed law, and this is the country in the portal where reading a stale source does the most damage.

On substance Mexico gives you no balancing ground. Processing needs the person's agreement except in a closed list of seven cases, and the one open to you is data needed to exercise a right or to comply with obligations arising from a legal relationship. Then comes the provision that inverts the intuition most readers arrive with: agreement is tacit as a general rule where the privacy notice has been made available and the person does not say otherwise. You are not chasing signatures in Mexico. You are getting the notice right, in its full and simplified forms, and a voice channel counts as a sound means, so decide in advance how the simplified notice reaches your workforce.

The heavier obligation is a labour one and it is triggered by consequences rather than by the exercise. Nothing makes the programme itself subject to joint drafting. But if you want a disciplinary consequence to rest on the internal work rulebook, everything that attaches to that instrument attaches to you: it is drawn up by a joint commission of worker and employer representatives, deposited with the federal conciliation and registration centre within eight days of signature, effective only from deposit, printed, distributed and posted at the workplace, and published in full for anyone to consult. A worker also has the right to be heard before a sanction is applied. So whatever you write there about a testing programme is a public document, and a programme that attaches no consequence to any individual is a much lighter proposition.

Two more provisions bear on design. There is a right to object to processing intended to evaluate, without human intervention, personal aspects including professional performance, reliability and behaviour, which is a reason to keep a human decision point between a result and anything that happens to a person. And processing personal data by deception, taking advantage of the error the person is in, is punishable by six months to five years, but only where it is done to obtain an undue profit. That element is what keeps an authorised internal exercise outside the offence, which is the reason to document the programme as assurance work before it runs rather than afterwards when somebody asks what it was for.

What your company needs to do

6 items, in the order you will need them.

  • Check every article number against the 2025 statuteMexico-specificA Mexican memo written before March 2025 cites a law that no longer exists and an authority that no longer exists, and both look entirely normal on the page. If a supplier or an adviser hands you a Mexican analysis, the first question is which statute it is numbered against.
  • Write the privacy notice in both forms before the first callMexico-specificThe contents are prescribed rather than left to judgement: who you are and where, what data and which of it is sensitive, the purposes with those needing agreement distinguished, how use can be limited, how access, rectification, cancellation and objection rights are exercised, and how changes will be communicated. Where data is collected by a sound means the simplified notice is what does the work, so decide the route it travels.
  • Decide now whether anything happens to an individual who failsMexico-specificThis is the Mexican decision. Consequences resting on the internal work rulebook bring the joint commission, the deposit, the posting, the publication and the right to be heard with them. A programme that reports at team level and attaches nothing to a named person does not go near any of it.
  • Keep a person between the result and the consequenceThe objection right is aimed at evaluation carried out without human intervention, and a programme that automatically scores named employees on how they handled a call is exactly what it describes. It is a right the individual exercises rather than a prohibition on you, and a human decision point answers it cheaply.
  • Record the relationship route, not a balancing assessmentThere is no legitimate interests entry in the closed list, so an assessment imported from a European programme is answering a question Mexican law does not ask. Write down instead why the exercise is necessary to obligations arising from the employment relationship.
  • Take the caller identity question to a Mexican carrierWe could not read the fundamental numbering plan or the successor regulator's current guidance, and we would rather say so than tell you Mexico has no rule. Present a number your own organisation holds and can be reached on, and settle the question with the carrier that will have to carry the traffic before a campaign rather than after one.

The controls that do the work

How Callstrike is configured, and which provision in Mexico each choice answers.

Auto-hangup before disclosure

The bot ends the call at the moment an employee starts to give up a credential or a piece of personal data, so the thing the pretext asked for is never spoken into the system and never stored.

The provision this sits closest to is the criminal one on processing personal data by deception. Be precise about the work each thing does: what keeps an authorised internal exercise outside that offence is its undue profit element, which is a fact about your purpose rather than about your call design. What this control does is remove the object. The call ends the moment an employee starts to give up a credential, so the pretext obtains no personal data at all, and it is also the cleanest answer to the statute's minimisation duty, since the shortest privacy notice to write is the one for data you never collect.

In-call debrief and follow-up

A second voice breaks character as soon as the call ends, explains what just happened and why it worked, and a follow-up email repeats it in writing while the moment is still sharp.

Mexico's heavy procedural route exists for consequences, so a programme that ends in vishing training rather than in a sanction stays clear of it by design. A second voice breaks character as the call ends and explains what just happened, and a follow-up email repeats it in writing. That is an awareness exercise on its face, and it is a very different thing from a result that arrives as a disciplinary matter under an instrument the whole workforce can read.

Consent Management

Two modes: collect consent now, over email, Slack or Teams with a full audit trail per employee; or record that your organisation already has this covered, by uploading the policy, handbook clause or agreement and confirming the scope it applies to. The document is hashed, the attestation is signed and timestamped, and an audit email is issued. Included on every plan.

Mexican agreement is tacit where the privacy notice has been made available, which sounds easy until somebody asks you to prove availability. This is what produces that proof: a dated, per-employee record that the notice actually reached a person before the campaign ran, rather than a claim that it was published somewhere. It is not the ground you are processing on, and this page does not present it as one.

SCORM module

An interactive web presentation on voice-phishing risk, delivered through your own LMS, which then invites the learner to opt into a web call with the bot. A call the person starts themselves in a browser is not a telephone call, so telephony rules do not reach it.

Two Mexican questions are open rather than answered: whether any synthetic voice disclosure duty is in force, and what the numbering plan we could not read actually says. A web call the learner starts themselves after working through the module does not wait on either, because you are not originating a telephone call to anybody. Callstrike's vishing simulator delivers the same deepfake voice that way, which means there is a Mexican answer even while those two questions stay open.

Consent Management is included on every plan. See AI voice phishing simulation and human-in-the-loop voice phishing for how each is delivered.

For your legal team

The sourced position

Everything above, with the instruments behind it. Every claim cites the statute or the regulator it comes from, so your counsel can verify it rather than rely on our summary.

A statute replaced outright, and a default nobody expects

Start with currency, because Mexico is the country in this portal where reading a stale source does the most damage. A single decree published in March 2025 enacted an entirely new federal data protection law for the private sector and abrogated the 2010 law it replaced, taking effect the day after publication. Every article number below is the new law's, and any guidance written against the old numbering is describing a repealed statute.

The same decree dissolved the regulator. The national transparency and data protection institute is gone, its functions and its staff transferred to the anti-corruption and good government ministry, which the new law names as the authority. That follows a constitutional reform on organisational simplification passed at the end of 2024, and the same reform extinguished the telecoms regulator, whose website now serves only as a historical archive pointing to its successor. A Mexican programme should be checking the successor bodies rather than the familiar acronyms.

On substance, Mexico is agreement-first and has no balancing ground. All processing is subject to the data subject's agreement except in the cases the law provides, and those cases are a closed list of seven: a legal provision so requiring, publicly accessible sources, prior dissociation, data required to exercise a right or comply with obligations arising from a legal relationship between the person and the controller, emergency, medical attention, and a judicial order. There is no legitimate interests entry and reaching for one would be importing a structure the statute does not have. The workable route for an employer is the fourth, resting on the employment relationship itself.

Then the provision that inverts the intuition most readers arrive with. Agreement is tacit where the privacy notice has been made available to the person and they do not express themselves to the contrary, and the law says that as a general rule tacit agreement is valid, except where the applicable provisions require it to be expressed. Mexico is therefore not a jurisdiction where you chase signatures. It is one where the notice is the deliverable, and where a defective notice is the failure.

The notice requirements are prescribed rather than left to judgement. The controller must inform the person, through the privacy notice, of the existence and principal characteristics of the processing, and the notice must contain at least the identity and address of the controller, the data to be processed with sensitive data identified, the purposes distinguishing those that require agreement, the options and means offered for limiting use or disclosure, the mechanisms for exercising access, rectification, cancellation and objection rights, and the procedure by which changes will be communicated. Where the data is obtained by electronic, optical, sound, visual or other technological means the notice is given in its simplified form, pointing to where the full one can be read. A voice channel is a sound means, so a Mexican programme needs to have decided in advance how the simplified notice reaches the workforce.

Three further provisions bear directly on how the exercise is run. A new purpose requires fresh agreement, so results gathered for awareness cannot quietly become an input to something else. Security measures and confidentiality controls are owed by everyone involved in the processing, which includes a supplier. And there is a right to object to processing intended to evaluate, without human intervention, certain personal aspects including professional performance, reliability or behaviour. That bears squarely on automatically scoring named employees on how they handled a call, and it is a reason to keep a human in the loop before any consequence attaches to an individual.

One criminal provision is worth reporting with its gate rather than without it. Processing personal data by deception, taking advantage of the error the data subject is in, is punishable by six months to five years of imprisonment, but only where done with the aim of achieving an undue profit. That element is what keeps an internal, non-profit-seeking security exercise outside the offence, and it is also why the exercise should be documented as an assurance activity before it runs. Administrative fines are separately calculated in units of measurement and double for sensitive data.

A carve-out written into the constitution, and a ceiling written beside it

Mexico answers the participant question in the constitution, which is stronger footing than the case law most countries rely on, and it is not where a reader would think to look.

Private communications are inviolable, and the law is to punish criminally any act against their freedom and privacy, except where they are voluntarily contributed by one of the private parties taking part in them. That is the carve-out, and it is constitutional text rather than interpretation.

We would rather state its shape than let it be over-read. The sentence immediately following says the judge is to assess the scope of such communications provided they contain information related to the commission of an offence, so the carve-out is drafted with criminal evidence in view. What it does is remove the inviolability objection to a recording made by a party. It is not a general authorisation to record staff, and that question is answered by the data protection law described above, which means the privacy notice has to cover the recording before the exercise runs. We have deliberately not cited a Supreme Court thesis here, so that nobody reads the constitutional provision as though it were also backed by case law we did not check.

Getting it wrong is expensive on a scale unusual even in this portal. Intervening in private communications without an order from a competent judicial authority carries six to twelve years of imprisonment and a fine of three hundred to six hundred days. A neighbouring provision punishes interrupting or interfering with wired, wireless or fibre communications where done deliberately or for profit.

And there is a ceiling worth knowing before anyone proposes to solve the problem with a court order. The same constitutional article provides that the federal judicial authority may not grant interception authorisations in electoral, fiscal, commercial, civil, labour or administrative matters. Labour is named. There is no judicial route to authorising interception in the employment context in Mexico, so the participant position is not merely the easiest answer, it is the only one.

The register is scoped twice, and the AI question is open

The Mexican rule people expect to apply here is the public register of consumers who do not want their information used for marketing, and it does not reach an internal exercise on either of the two scopings it carries.

The consumer protection statute empowers the consumer agency to keep a public register of consumers who do not wish their information to be used for marketing or advertising purposes. The prohibition that goes with it is addressed to suppliers, and to undertakings that use consumer information for marketing or advertising purposes and their clients, forbidding them to use consumer information for purposes other than marketing or advertising and to send advertising to consumers who have said they do not want it or who are on the register.

The statutory definitions close it off. A consumer is a natural or legal person who acquires, uses or enjoys goods, products or services as final recipient. A supplier is a person who habitually or periodically offers, distributes, sells, leases or grants the use of goods, products and services. An employer testing its own staff is not acting as a supplier, an employee receiving the call is not a consumer in that transaction, and the calls are not advertising. So the register is outside the picture on the actor scoping and on the purpose scoping alike, and neither turns on whether the voice is synthetic.

On artificial intelligence and synthetic voice, we are going to be straightforwardly unhelpful rather than falsely reassuring. We did not establish whether Mexico has a disclosure duty in force, and we assert neither that one exists nor that none does. The legislative information system was not driven to a bill listing within this research, and the institutional upheaval of 2024 and 2025 makes an assumption based on the pre-reform landscape unsafe. If your scenario uses a synthetic voice in Mexico, treat this as an open question to check rather than as a settled negative, and note that the data protection statute's objection right for automated evaluation applies regardless of how that question resolves.

A regulator that changed name, and a plan we could not open

This is the section where we have less for you than we would like, and saying so precisely is more useful than filling the space.

What is established is institutional. The federal telecommunications institute no longer operates as the regulator. Its own domain now serves a banner stating that the site is a historical archive available for consultation only and directing current procedures and services to the telecommunications regulatory commission. That extinction traces to the constitutional reform on organisational simplification published in December 2024, which the March 2025 data protection decree refers to expressly when it deals with the transitional arrangements. So any Mexican caller identity question has to be taken to the successor body, and any instrument located under the old regulator's name should be checked for whether it survived.

What is not established is the substantive rule. We could not read the fundamental technical numbering plan or the successor regulator's current numbering guidance: the legislature's own site was unreachable throughout, the archived regulator's numbering page exposes no link to the plan, and the successor's site returns a challenge page to every automated request.

That is an unread source and not a finding. We are not telling you that Mexico has no anti-spoofing rule, because we did not read the documents where such a rule would most naturally sit. Treat the question as open, and resolve it with a Mexican carrier before a campaign rather than after one, since the carrier is the party that would have to carry the traffic in any event.

What we can say is what follows from the rest of Mexican law rather than from telecoms regulation. Presenting a number belonging to a real third party, particularly a bank or a government line, sits near the criminal deception provision described in the first section and near ordinary fraud offences, and the practical answer everywhere else in this portal is the same one: present a number your own organisation holds and can be reached on. That answer costs nothing and does not depend on the document we could not open.

What the country matrix holds for Mexico

Number types:
Local
Restricted for automated outbound:
None recorded

Generated from the same country matrix the platform enforces at dispatch, so it cannot drift from what you can actually buy.

A rulebook drafted jointly, deposited to take effect, and then published

Mexico has the heaviest procedural footprint of the three large Latin American markets in this portal, and it comes from labour law rather than from privacy law.

The instrument is the internal work rulebook, and the statute prescribes how it is made. It is to be drawn up by a joint commission of representatives of the workers and of the employer. If the parties agree, either of them is to deposit it with the federal centre for conciliation and labour registration within the eight days following signature. That deposit body changed in the 2019 labour reform, so a source naming the old boards is out of date. Provisions contrary to the statute have no legal effect, and either the workers or the employer may at any time ask the federal courts to supply omissions or review provisions that are contrary to the law.

Three consequences follow that are easy to miss. The rulebook takes effect from the date of deposit, not from signature. It must be printed, distributed among the workers and posted in the most visible places of the establishment. And the deposited text is made public: the registration centre publishes the full text of deposited rulebooks for anyone to consult. Whatever you write about a testing programme in that instrument is therefore a public document, which is a consideration in how much operational detail it should carry.

The hooks a programme would hang on are the disciplinary limb, covering disciplinary provisions and the procedures for applying them, and the residual limb covering other rules necessary and convenient according to the nature of the undertaking to achieve greater safety and regularity in the work. The disciplinary limb was amended at the end of 2024 and now provides in terms that the worker has the right to be heard before a sanction is applied, with suspension capped at eight days.

The precise reading matters and it is narrower than it first looks. The statute does not make a simulation programme itself subject to joint drafting. What it does is make the rulebook a jointly drafted, deposited, published and posted instrument, so that if the employer wants the programme, and especially any disciplinary consequence flowing from it, to rest on that rulebook, all of those requirements attach. A programme that attaches no consequence to an individual is a much lighter proposition than one that does, and this is the point at which that design choice gets made.

So the Mexican file is: the privacy notice in its full and simplified forms, covering the programme and the recording and delivered by a means that suits a voice channel; a record of the legal relationship route rather than an assertion of a balancing test that does not exist here; a decision about whether results feed any automated evaluation of an individual, given the objection right; and, where consequences attach, the rulebook route with the joint commission, the deposit and the right to be heard built in from the start.

The supervisor's rules stayed shut, and we are not going to guess at them

We could not obtain the text of the Mexican banking supervisor's general provisions, and we are not going to describe what we did not read. The supervisor's own domains return a bot challenge page to every automated request and its certificate could not be verified by our fetcher, so we have no term counts and make no claim about what Mexican financial-sector rules require of a security awareness programme.

That is a gap in this page rather than a finding about Mexican law. Anyone in a supervised financial institution should read those provisions directly, and should expect the institutional changes of 2024 and 2025 to have moved some things, because they moved the data protection authority and the telecoms regulator.

What does apply across every sector is the general obligation in the data protection statute, and it is worth stating because it is the floor everywhere. The controller must establish and maintain security measures for the personal data it processes, and confidentiality obligations bind everyone who intervenes in any phase of the processing, including after the relationship with the controller ends. A supplier running the exercise is inside that, so the contract has to say so.

The other cross-sector provision to weigh is the right to object to processing intended to evaluate, without human intervention, personal aspects including professional performance. Programmes that produce a per-employee score, and especially those that feed it into an appraisal, are the ones this reaches. It is not a prohibition and it is not triggered by the exercise as such; it is a right the individual can exercise, and the practical answer is a human decision point between the result and any consequence.

Finally, and honestly, we did not establish whether Mexico has any artificial intelligence instrument in force that would bear on a synthetic voice, and the 2011 implementing regulation's survival is genuinely ambiguous on the face of the 2025 decree, which abrogates four named laws without mentioning it while the new statute still defines the term. Both are open questions rather than settled ones, and we would rather list them than let their absence read as a clean bill.

Take this further

Research prompt for your own AI assistant

Paste into Claude, Harvey or your firm's tool to pressure-test the position above.

You are advising on an authorised internal security exercise in MEXICO. Our own employees receive a simulated voice-phishing call, placed by our vendor on our instruction, to measure susceptibility. No credential is captured or stored. The workforce is informed in advance through our privacy notice.

Verify or correct each proposition below against primary Mexican sources, and tell me what we must produce before the first call:

1. The LFPDPPP published in the DOF on 20 March 2025 abrogated the 2010 statute and entered into force the following day, and the authority is now the Secretaria Anticorrupcion y Buen Gobierno.
2. Art 9 is a closed list of seven with no legitimate-interests entry, and fr. IV is the route open to an employer.
3. Art 7 makes tacit agreement valid as a general rule where the aviso de privacidad has been made available, and confirm what the simplified notice must contain where data is collected by a sound means.
4. CPEUM art 16 excepts communications voluntarily contributed by a participant, and bars judicial interception authorisations in materia laboral.
5. LFT arts 424, 424 Bis and 425: joint commission, deposit with the Centro Federal de Conciliacion y Registro Laboral within eight days, effect from deposit, publication of the deposited text, and art 423 fr. X's right to be heard before a sanction.
6. Art 63's deception offence is gated on the aim of an undue profit, so an internal exercise without that aim is outside it.
7. The objection right to evaluation without human intervention, and how it applies to per-employee scoring.
8. Whether any Mexican instrument in force requires disclosure of a synthetic or AI-generated voice, and whether the 2011 Reglamento survived the 2025 decree.

Flag anything that has changed since September 2026, and identify any state-level or collective-contract obligation this analysis omits.

Common questions

Is Mexican guidance written before 2025 still usable?
No. A decree published in March 2025 enacted an entirely new federal data protection law for the private sector, abrogated the 2010 statute and dissolved the regulator, transferring its functions to the anti-corruption and good government ministry. Article numbers and the enforcing body have both changed.
Do we need signed agreement from every employee?
No, and chasing signatures misreads the statute. Agreement is tacit where the privacy notice has been made available and the person does not object, and the law says tacit agreement is valid as a general rule. The notice, in full and simplified forms, is the deliverable that matters.
Can we record the calls in Mexico?
The constitution itself excepts communications voluntarily contributed by one of the parties taking part in them, so a participant recording is outside the inviolability rule. It is still processing of personal data, so the privacy notice must cover it before the exercise runs.
Does the workplace rulebook have to mention the programme?
Only if you want consequences to rest on it. The rulebook is drafted by a joint commission of worker and employer representatives, takes effect on deposit with the federal registration centre, is posted at the workplace and is published for anyone to read, and a worker must be heard before any sanction.

Elsewhere in the Americas

The rules differ by country even inside one region. These are the nearest guides to this one, each showing how phone numbers are obtained there.