New Bank Transfer Requirements: Important Update and Alerts

Banking institutions are updating security requirements for fund transfers to combat fraud, specifically targeting the replacement of traditional coordinate cards with digital authentication methods, according to reporting from El Mostrador on July 17, 2026. These changes aim to eliminate physical security tokens that are increasingly vulnerable to social engineering and phishing attacks.

The shift centers on the transition from coordinate cards—physical lists of numbers used to authorize transactions—to dynamic security keys and biometric verification. According to El Mostrador, banks are implementing these updates to prevent unauthorized access to accounts, as criminals have developed methods to trick users into revealing their coordinate sequences during fraudulent phone calls or via fake websites.

Coordinate cards were designed as a secondary layer of security, but their static nature makes them a liability. Once a fraudster obtains the physical card or convinces a user to read the numbers aloud, they can execute transfers from the victim’s account without further hurdles. The new requirements prioritize “out-of-band” authentication, where the authorization happens on a separate device or through a secure app.

Financial institutions are now requiring customers to activate digital tokens within their mobile banking applications. These tokens generate a unique, time-sensitive code for every transaction, meaning a code used for one transfer cannot be reused for another. This differs from the coordinate card system, where the same numbers remain valid for the life of the card.

The updated security protocols generally include the following verification methods:

• Biometric Authentication: Use of fingerprints or facial recognition to authorize high-value transfers.
• Digital Tokens: Temporary codes generated inside the bank’s official app.
• Push Notifications: Direct alerts sent to a registered mobile device that require a “Yes/No” confirmation for a specific transaction amount and recipient.
• Two-Factor Authentication (2FA): Combining a password with a secondary, dynamic piece of evidence.

El Mostrador notes that these changes are part of a broader effort to mitigate “vishing” (voice phishing), where attackers pose as bank employees. In these scenarios, scammers often pressure victims into providing coordinate numbers under the guise of “securing” the account or “blocking” a fraudulent charge. By removing the coordinate card from the equation, banks eliminate the primary tool used in these specific social engineering tactics.

For users who still rely on physical tokens, banks are urging an immediate migration to digital platforms. The transition often requires a one-time setup process, which may include verifying identity through a government-issued ID or visiting a physical branch to link a mobile device to the account.

The industry-wide move reflects a transition toward “Zero Trust” architecture in retail banking. Rather than trusting a physical object held by the customer, banks now verify the identity of the user and the integrity of the device in real-time. This reduces the window of opportunity for attackers to intercept credentials and use them for unauthorized fund movements.