Sliding the needle into the side of a plastic casing isn’t how most people imagine a financial audit beginning, but in a small, sweltering room in Tijuana, that is exactly the atmosphere.
The privacy researcher, let’s call her Elena, isn’t using a needle, but the digital equivalent: a packet sniffer and a clean, factory-reset Android device. The humidity is at , and the air smells like the street tacos from the vendor below her window. She is about to install a series of microloan apps, the kind that promise money in , and she knows exactly what she is signing away.
Permission Extraction Log:
-
✕ Contacts & SMS History
-
✕ GPS Real-time Tracking
-
✕ Microphone & Battery Metrics
On her screen, the first app-a popular choice among those rejected by traditional banks-requests access to her contacts. Then her SMS. Then her GPS. Then her microphone. Then her battery level.
“Este teléfono ahora vale más para ellos que para mí.”
– Elena, scribbling in a notebook with a frayed edge.
“This phone is now worth more to them than it is to me,” she mutters.
From the Buró de Crédito to Real-Time Telemetry
For decades, the Buró de