Written for Mexico. This analysis applies to Mexican federal tax law — ISR (income tax), IVA (VAT) and SAT rules — and cites Mexican statutes. Amounts are in Mexican pesos (MXN).
In tax matters almost everything can be defended: positions, valuations, deductions, structures. But there are three behaviors where there is no position to argue because the money, quite simply, was not yours — or the transaction, quite simply, never existed. They are the three files no litigator wants and the three the authority detects by machine. If you're going to be flawless at anything, let it be this.
Sin 1: pocketing the withholdings
The ISR (income tax) you withhold from your workers and suppliers is their money, which you administer in transit to the treasury. Using it as working capital is the classic move of cash-strapped companies — and the most expensive: the CFF equates it to the crime of aggravated tax fraud when withheld amounts are not remitted (arts. 108-109), liability reaches company directors personally (art. 26), and the cross-check is instant: the payroll CFDI that stamps the withholding is the confession, and the return that fails to remit it is the crime. There is no gray zone to argue — only the size of the problem.
Sin 2: keeping the VAT you charged
Same principle: the IVA (VAT) you pass on to your clients was never your income — you are the collector. The difference between VAT charged and creditable VAT is remitted month by month, and the SAT knows it before your accountant does: every CFDI you issue and receive feeds the calculation in real time. "Manually adjusting" the return against what the invoices say is leaving a self-documented discrepancy — an invitation letter first, an assessment later, and in serious amounts and behaviors, the same criminal door as sin one.
Already in one of the three?
The order of priorities is surgical: withholdings and VAT get corrected immediately — unprompted self-correction stops the criminal escalation and the fines on what you correct. Bought invoices demand a case-by-case strategy (self-correction, proof of substance where it exists, defense). Strategium quantifies your real exposure and executes the least costly exit. The one thing that doesn't work is waiting.
Sin 3: buying invoices
Simulating transactions stopped being a tolerated sport a decade ago: art. 69-B publishes the issuers (EFOS) and pursues the buyers (EDOS), art. 113-Bis punishes the issuance, sale and acquisition of invoices for nonexistent transactions with prison — a crime that, moreover, warrants pre-trial detention in certain serious scenarios — and detection technology improves every year: a company with no employees, no assets and no infrastructure that "invoices" millions in specialized services is a pattern, not a mystery. The buyer is always found out, because its deduction points straight to the flagged issuer. And as the colleague in the reel rightly says: it isn't just criminal risk — it's unnecessary: virtually everything a fake invoice tries to achieve has a well-structured legal version.
Frequently asked questions
My company used the withholdings to cover payroll in a critical month — what do I do?
Fix it immediately: an amended return, remittance with inflation adjustment and late-payment surcharges, ideally before any request from the authority — correcting unprompted (art. 73 CFF) avoids fines and deactivates the criminal route for those facts. And solve the underlying problem: if cash flow forces you to touch withholdings, the problem is financing, not tax.
I bought invoices three years ago on the advice of a firm — is it past the statute of limitations?
The authority's audit powers reach five tax years (more in aggravated cases), and the criminal exposure runs on its own clock. The self-correction window is still open and remains your best card — a serious analysis weighs the cost of correcting against the total exposure, and correcting almost always wins. 'A firm recommended it to me' is not a defense, but it can be grounds for action against whoever sold it to you.
How do I tell a real supplier from an invoice mill before signing?
Check the 69-B lists, the compliance opinion, and apply the substance test: does it have employees (REPSE if applicable), offices, a track record, real capacity for what it offers? If the price is too good and the company too new, you already know what it is. Your supplier due-diligence file is, moreover, your defense if one gets flagged later.
Let's talk about your case
The first step is always the same: an honest diagnostic of where you stand. Write to us on WhatsApp or call — a reply the same business day.