Peruvian Loan Scam Harvests Cards and PINs via Fake Applications

A large-scale phishing campaign active since 2024 uses targeted social-media ads and fake loan-application sites to impersonate banks across Peru and other Latin American countries, harvesting validated card numbers, 6-digit PINs and online-banking credentials; researchers observed ~370 domains and ~35 ads and warn financial institutions to improve customer education, multi-factor authentication, digital risk monitoring, and intelligence sharing.