Colombia Threat Letters: What Counts as Asylum Evidence

Last updated: 6 October 2026

Colombia threat letters are often the only physical proof a client brings out of the country. Armed groups still leave pamphlets under doors, but they now also send WhatsApp audios, text messages, phone calls and even digital funeral wreaths. In 2025, digital threats against human rights defenders outnumbered paper pamphlets for the first time.[1] So the question many lawyers ask, "is a phone threat enough evidence?", now applies to every format.

This guide covers how the Clan del Golfo, the ELN, FARC dissident factions and urban gangs deliver threats, and who receives them. It then explains how Colombia records threats and how UK and US decision-makers weigh them. A checklist and common questions follow, and we date and footnote every figure.

Why Colombia threat letters matter in 2026

A threat in Colombia is usually the first step in a sequence that can end in displacement or death. The 2026 context makes that sequence more likely.

Armed groups have grown fast. The Fundación Ideas para la Paz (FIP) counted 15,120 members of organised armed groups in December 2022 and 28,802 by July 2026, a rise of 90%.[2] Meanwhile, President Abelardo de la Espriella took office on 7 August 2026 and, on 31 August, ended talks with three armed groups inherited from the "total peace" policy.[3] As a result, the state has chosen open confrontation over negotiation. Our Colombia country conditions report covers the armed group map and the 2026 security policy in detail.

Killings remain high. Indepaz recorded 187 social leaders killed in 2025, up from 173 in 2024.[4] Similarly, the Defensoría del Pueblo counted 112 killings between January and August 2026, with 22 in August alone.[5] For events between 1 January and 1 August 2026, the Unidad para las Víctimas added 8,124 people to the national victims register (RUV) for "amenaza". Only forced displacement produced more registered victims.[6]

How Colombian armed groups deliver threats

Colombia threat letters are only one format among many, and each format leaves a different evidential trail. Therefore, identify the format first and then ask what proof it can produce.

Panfletos and typed letters

The panfleto is the classic threat. It is a printed or typed sheet, often with a group name, a bloque or frente, and a list of targets declared "objetivo militar" (military target). Groups leave them under doors or share photos of them on WhatsApp. For example, in January 2026 a pamphlet signed by the Frente Carolina Ramírez, part of Iván Mordisco's EMC, was left at a news outlet's building in Mocoa. It declared two of its journalists military targets.[7]

Pamphlets raise a specific credibility problem, because some are fake. For instance, Bogotá police said in March 2024 that a "social cleansing" pamphlet on social media was false and had circulated the year before, even abroad.[8] Groups also deny authorship. In November 2024, the Ejército Gaitanista de Colombia (EGC) called a pamphlet in Cesar that bore its name "completamente falso" (completely false).[9] A denial does not prove a pamphlet is fake, because groups have reasons to disown threats. However, it means the pamphlet needs support from other evidence.

Handwritten notes and boleteo

Colombians call extortion demands "boleteo" or "vacunas". They arrive as handwritten notes, typed letters, calls or messages. The UK Home Office CPIN records that groups use "the threat of violence, or actual violence, including bombings" when targets do not pay.[10] OHCHR describes extortion as so widespread that in some regions it chokes local economies.[11] Handwritten notes rarely carry a group name. Consequently, attribution depends on who controls the area and what happened after the client refused.

Sufragios and funeral wreaths

A sufragio is a funeral card sent to a living person, and a corona is a funeral wreath. Both tell the recipient that they are already counted as dead. In April 2026, images of funeral wreaths with photographs of presidential candidates Paloma Valencia and Abelardo de la Espriella circulated on X with the words "Descanse en paz" and the year 2026.[12] A sufragio is usually anonymous, but an expert can explain its meaning to a tribunal.

Phone calls, WhatsApp texts and audios

Digital threats now rival Colombia threat letters on paper. According to El Tiempo's report on Somos Defensores data, defenders received 164 digital threats in 2025, more than pamphlet threats for the first time.[1] Calls are hard to prove because they leave only a call log. WhatsApp messages and voice notes, in contrast, leave a file with a date, time and sender number.

Phone threats also risk confusion with ordinary crime. In Colombian cities, gangs run extortion calls from prisons, and some callers falsely claim to belong to an armed group. Decision-makers may therefore argue that the call was a scam. The answer lies in context. Did the caller know the client's name, role, address or family? Did a visit, a second message or an attack on a relative follow?

Lists and "military objective" declarations

The CPIN confirms that armed groups and gangs declare people who oppose or hinder them "military objectives" and may threaten family members to reach them.[10] In Catatumbo, the ELN declared FARC peace signatories military targets after January 2025. About 240 signatories fled their homes that year.[13] Keep the whole list, because the other names show who the group targeted.

In person and through intermediaries

Many threats leave no document at all. Armed men visit a house or send a message through a neighbour. On 31 July 2026, for example, people approached four journalists in Apartadó, Antioquia, by phone, through acquaintances and in person, all within six hours. They demanded that the journalists stop reporting on a local official, and FLIP attributed the pressure to the Clan del Golfo.[14] Here, testimony and the group's known practice carry the weight.

Who receives threats in Colombia

Colombia threat letters and calls go mainly to people who organise others, report abuses, compete for land or refuse to cooperate.

Social leaders and JAC presidents. Presidents of Juntas de Acción Comunal (community action boards) sit between the community and the armed group. OHCHR received allegations in 2025 of threats against social leaders who disagreed with the EMBF's social control over community boards and peasant groups.[11] Somos Defensores recorded 874 attacks on defenders in 2025, a 20% rise on 2024. Threats alone rose by 19%.[15]

Land claimants. Restitution claims touch land that armed groups use for coca, mining or cattle. In Urabá and Córdoba, the claimant often lives in an area under Clan del Golfo control. We explain how that control works in our analysis of the Clan del Golfo's machinery of control.

Ex-FARC signatories. The UN Verification Mission verified 45 killings of former combatants in 2025, up from 33 in 2024. The Mission has counted 486 such killings since 2016.[11] Dissidents see them as traitors, while the ELN sees them as possible informants.

Journalists. The Fundación para la Libertad de Prensa (FLIP) documented 469 attacks on 305 journalists in 2025. These included 192 threats, 15 forced displacements and seven cases of exile.[16]

LGBT people. Caribe Afirmativo recorded 270 homicides of LGBTIQ+ people in 2025, up 63% on 2024. It also reported that 99.8% of threat cases never passed the preliminary inquiry stage.[17]

People who refuse recruitment or extortion. OHCHR recorded 150 cases of child recruitment in 2025 and warned about armed groups using social media to recruit children.[11] Parents who refuse, and shop owners who will not pay, often receive the first threat by phone or WhatsApp.

Our video on why people flee Colombia features Íngrid Betancourt, Francia Márquez and Berenice Celeyta. Watch it on our YouTube channel.

Why People Flee Colombia: Íngrid Betancourt, Francia Márquez & Berenice Celeyta

How threats are recorded in Colombia

Several bodies in Colombia record threats, from threat letters to calls. Each produces a different document that proves something different.

The criminal law covers threats directly. Article 347 of the Penal Code (Law 599 of 2000) punishes threats in general. Article 188E punishes anyone who, "por cualquier medio" (by any means), threatens a human rights defender, a political or union leader, or their relatives.[18] These words cover WhatsApp and phone threats as much as letters.

The UNP decides protection through a risk assessment. A technical team gathers information, and an inter-agency committee, the CERREM, recommends measures.[19] A UNP finding of "extraordinary" or "extreme" risk is strong evidence, but the reverse does not follow. The CPIN on actors of protection reports that the UNP received 30,413 individual protection requests between 2016 and 2022 but started risk assessments in only 6,923 cases.[20] So the absence of a UNP assessment says little about the real risk.

Victims register with the RUV by making a declaration before the Ministerio Público, which includes the Personería and the Defensoría.[21] Defensoría early warnings (alertas tempranas), by contrast, name municipalities, groups and populations at risk. For example, Early Warning 013 of 2025 identified 649 municipalities needing immediate action ahead of the 2026 elections.[11] An early warning that names the client's municipality and the group that threatened them is often the best independent support available.

Why many victims do not report threats

Expect the Home Office or DHS to ask why a client with Colombia threat letters did not go to the police. First, impunity is very high. Somos Defensores puts impunity for killings of defenders at 86%.[15] Moreover, of 266 Fiscalía cases of digital violence against defenders documented to February 2026, none had reached trial.[1]

Second, reporting can make things worse. OHCHR found that armed groups threaten relatives of kidnapped people so that they do not report, which causes high under-registration. It also described groups imposing a "ley del silencio" (law of silence) on local leaders.[11] Third, there are concerns about collusion. The CPIN on actors of protection notes that people avoid reporting because of "fear of adverse consequences" where armed groups are present, and that armed groups pay soldiers for services.[20] Link each point to the client's own area and reasons.

How UK decision-makers assess Colombia threat letters

In the UK, the starting point for any document, including Colombia threat letters, is Tanveer Ahmed [2002] UKIAT 00439. The claimant must show that the decision-maker can rely on a document. The decision-maker then weighs it with all the other evidence. In most cases, the Home Office does not need to prove forgery, and the tribunal does not need to find it.[22]

The Upper Tribunal confirmed this approach in QC (verification of documents; Mibanga duty) China [2021] UKUT 33 (IAC). The overarching question is whether the document "can be regarded as reliable". A duty on the Home Office to verify arises only rarely: where the document is central, can easily be authenticated, and authentication would leave no live issue about its contents.[23] An anonymous WhatsApp audio or an unsigned panfleto will almost never meet that test. Therefore, the claimant must build reliability through context.

QC also helps claimants. The greater the cogency of a piece of evidence, the more the judge must explain why it did not change the outcome.[23] In practice, the judge must deal with an expert report that links the threat to a named group's known practice.

For claims made on or after 28 June 2022, section 32 of the Nationality and Borders Act 2022 applies. Under it, a judge decides on the balance of probabilities whether the claimant has the relevant characteristic and actually fears persecution. The lower "reasonable likelihood" standard still governs whether they would face persecution on return.[24] The Upper Tribunal explained this split in JCK (s.32 NABA 2022) Botswana [2024] UKUT 100 (IAC). A threat letter usually supports both stages, because it shows how the group saw the client and what it intends.

Country evidence then does much of the work. The March 2026 CPIN on armed groups accepts that the state is "willing but is unlikely to be able" to protect against the most powerful groups, such as the AGC and the ELN.[10] Its risk test asks whether the client is seen as a military target or seriously opposes the group, and whether the group has significant control in the area. A threat letter is direct evidence on the first limb. However, the CPIN also says internal relocation is in general likely to be reasonable. Evidence that the group followed the client, or threatened relatives later, is therefore important. Our article on clients who were found again after relocating in Colombia covers that issue.

How US adjudicators assess Colombia threat letters

In the US, the REAL ID Act sets the framework. Under INA § 208(b)(1)(B)(ii), a judge may require corroboration of otherwise credible testimony, unless the applicant does not have it and cannot reasonably obtain it. Under § 208(b)(1)(B)(iii), credibility rests on the totality of the circumstances.[25] Matter of S-M-J-, 21 I&N Dec. 722 (BIA 1997), established that corroboration is expected where it is reasonably available. Moreover, Matter of L-A-C-, 26 I&N Dec. 516 (BIA 2015), held that the judge need not warn the applicant in advance which documents are needed, but must let them explain why evidence is missing.[26]

In Matter of H-L-H- & Z-Y-Z-, 25 I&N Dec. 209 (BIA 2010), the Board gave little weight to unsworn letters from interested people who were not available for cross-examination.[27] Consequently, a relative's letter saying "they came looking for him" is weak on its own, while a Fiscalía denuncia or UNP resolution is an official record.

Authentication is flexible. Certification under 8 CFR § 1287.6 is one way to authenticate foreign official records, but not the only way. In any case, Colombia threat letters are not official records. The Third Circuit held in Gui Cun Liu v. Ashcroft, 372 F.3d 529 (3d Cir. 2004), that a judge errs by rejecting documents solely for lack of certification. The Ninth Circuit took the same view in Vatyan v. Mukasey, 508 F.3d 1179 (9th Cir. 2007).[28]

Are threats alone persecution in US law?

Usually not, which is why corroboration of what followed matters. The Ninth Circuit said in Lim v. INS, 224 F.3d 929 (9th Cir. 2000), that threats alone amount to persecution only in a "small category of cases".[29] In a Colombian case, Sepulveda v. U.S. Attorney General, 401 F.3d 1226 (11th Cir. 2005), the Eleventh Circuit held that menacing phone calls and threats did not reach the level of past persecution. However, in De Santamaria v. U.S. Attorney General, 525 F.3d 999 (11th Cir. 2008), the same court found persecution where FARC threats were followed by attacks, the murder of a family friend and a kidnapping, viewed together. It also noted that "courage does not negate fear".[29]

So a threat claim is strongest as part of a proven pattern. Even so, a client who received only threats can still show a well-founded fear of future harm. Note also Urias-Orellana v. Bondi (4 March 2026), a case about threats from a hitman in El Salvador. There, the Supreme Court held that appeal courts review the whole persecution finding under the deferential substantial-evidence standard.[30] As a result, the record before the immigration judge matters more than ever.

Strong and weak threat evidence

How the client keeps and explains Colombia threat letters and messages decides much of their weight. The UNHCR Handbook notes that the duty to establish the facts is shared between the applicant and the examiner.[31] Still, the lawyer controls most of what makes evidence strong.

Expert evidence ties these strands together. A country expert can say whether the wording and signature of Colombia threat letters fit the named group, and whether a call looks like prison extortion or targeted pressure. We cover the wider legal framework in our guide to Colombian asylum claims based on FARC and ELN persecution.

Colombia threat letters: evidence checklist

This list covers Colombia threat letters as well as phone and WhatsApp threats.

1. Keep every original. Do not laminate, write on or staple paper threats. Keep the envelope.
2. Keep the phone that received the threats. Do not reset it or delete the chat.
3. Export the full WhatsApp chat with media, and save voice notes as original audio files.
4. Take screenshots that show the sender's number, date and time, plus the call log for calls.
5. Write a dated note of each call or visit as soon as possible: who, when, where, exact words.
6. Obtain certified Spanish-to-English translations, and keep the Spanish text alongside.
7. Collect any Fiscalía denuncia, Personería record, UNP resolution or RUV decision.
8. Find the Defensoría early warning that covers the client's municipality.
9. Get statements from witnesses who saw the threat arrive.
10. Prove the client's role: letters from the JAC, cabildo, union, NGO or employer.
11. Record what happened after the threat, including threats to relatives after departure.
12. Instruct a country expert to assess the threat against the group's known practice.

Common questions

Is a single WhatsApp threat enough for asylum?

Rarely on its own. A single message proves little about who sent it or what the sender will do. However, a single threat can carry a claim when the client's profile is clear, the group controls the area and similar people have been attacked there. The threat then becomes one piece of a consistent picture.

What if the client deleted the messages?

Ask why. Many clients delete threats out of fear or because a relative checks their phone. WhatsApp backups, the other phone in the chat, or screenshots sent to family may still exist. Otherwise, the client's detailed account, given consistently, has to carry the point.

Did the client have to report the threat to the police?

No. Neither UK nor US law makes a police report a condition of protection. However, the client should explain why they did not report. The impunity, fear and collusion evidence above usually provides that explanation, especially in areas under armed group control.

Do threats received after the client left Colombia count?

Yes. Colombia threat letters or messages sent to relatives after departure are often the best evidence that the group still has an interest in the client. They are also directly relevant to internal relocation. Keep them like earlier threats, with statements from the relatives.

Conclusion

Colombia threat letters, calls and WhatsApp messages are real evidence that UK and US decision-makers must weigh. On their own, however, they rarely win a case. Their strength comes from originals with metadata, a clear chain of custody, a fit with the named group's practice, and local corroboration such as a Defensoría early warning.

The 2026 context supports these claims. Armed groups have almost doubled since 2022. In addition, the Home Office accepts that the state is unlikely to be able to protect people against the AGC and the ELN. You can find a Colombia expert witness here. For a case study of how protection fails at department level, see our report on the collapse of state protection in La Guajira.