This week’s revelations from Publimetro are a sobering reminder of the fragile underpinnings of a fully digital financial ecosystem. The report alleges that databases held by banks, Mexico’s tax authority (SAT), and even the national electoral institute (INE) were being offered for sale on a hacker forum—for as little as $5,000. It’s a striking example of the systemic vulnerabilities that arise when cash disappears and data becomes currency.

For years, advocates of digital finance have praised the efficiency, traceability, and convenience of cashless systems. Yet few have grappled seriously with the question of resilience: what happens when the data infrastructure that underpins these systems is breached, manipulated, or simply fails?

Photo credit: Image by freepik

Chris Skinner has long argued that trust—not technology—is the real currency of digital finance. In a post on The Finanser, he explores the tension between surveillance and security, warning that the shift from physical cash to digital payments creates the conditions for both unprecedented insight and exploitation. The Mexican case makes this point vividly clear. Once transactional data becomes centralised and monetised, individuals become targets—consumers of services but also products sold on shadowy markets.

David Birch has similarly underscored the dangers of conflating anonymity with privacy. On his Forbes column, he makes the case for privacy-enhancing digital systems—ones that allow for transactional confidentiality without enabling criminality. Yet these systems require careful design and governance, underpinned by a robust digital identity framework. In contexts like Mexico, where identity data is already at risk, the dream of privacy-preserving fintech rings hollow unless it is supported by strong safeguards.

The sale of these datasets also raises questions about dispute resolution and recourse. In a cash-based system, the harm from a compromised wallet is immediate but limited. In a data-driven society, the effects of breach can be diffuse, long-term, and nearly impossible to trace. What happens when your biometric ID is leaked? When your tax history or electoral data is exploited? Who do you call? How do you prove harm?

In this light, resilience must become a core principle of cashless design. Redundancies, decentralisation, and user agency aren’t just technical concerns—they are political ones. As Birch has said elsewhere, “[cashlessness] needs to be part of an overall strategy—and that includes inclusion and identity” (Seamless Xtra).

Inclusion cannot mean surveillance. And digital convenience cannot come at the cost of civic trust. The Mexican case serves as a wake-up call, not only to regulators and fintech firms, but to all of us who live increasingly mediated lives. As the cashless society becomes reality, it is imperative we ask: whose data, whose rules, and whose responsibility when things go wrong?