Korea issues phishing warning after financial-sector data leaks

The Personal Information Protection Commission said Tuesday that financial authorities have issued a consumer advisory warning against voice phishing and text-message scams that could follow recent personal data leaks at financial companies.

The warning, issued jointly with financial regulators, reflects concern that criminals may combine leaked names, addresses and financial details to pose as bank or Financial Supervisory Service staff offering low-interest loans, debt refinancing or compensation for the leaks. Because scammers can cite a target's actual income and borrowing limits, the commission said, consumers should not assume a call is legitimate simply because the caller knows their information. Authorities and financial companies never ask for passwords or verification codes by phone or message, never demand money transfers to protect assets, and never require advance payments or app installations as part of a loan.

No case has yet been confirmed in which customer funds were stolen through voice phishing linked to the recent leaks, and the leaked data did not include passwords or one-time passcodes, the commission said.

Financial authorities designated a one-month special response period for second-stage damage starting Oct. 6, extendable if needed, and convened an emergency inspection meeting that afternoon at the Financial Supervisory Service with banks, securities firms, mutual finance and credit finance companies, the Digital Asset eXchange Association and the Financial Security Institute. Regulators instructed the companies to operate dedicated customer service desks, strengthen their abnormal transaction detection systems to catch fraud built on the leaked data, and share voice phishing intelligence through the ASAP artificial intelligence platform.

Consumers were told not to click on internet addresses in messages from unidentified senders and to delete such messages immediately, and to confirm whether their data was exposed only through a financial company's official website, app or customer service number. The commission also advised against storing identity verification information such as resident registration numbers, account passwords or copies of identification cards on mobile phones.

To guard against loans taken out fraudulently in their names, consumers can sign up for the three-part Financial Transaction Safety Block service, which prevents unauthorized lending, non-face-to-face account opening and open banking. Enrollment stood at about 7 million as of the end of August, with duplicate sign-ups counted. Applications can be made at a branch of a financial company or through the payinfo.or.kr account portal or bank apps, and the service can be lifted at any time. Consumers can also register with the Personal Information Exposure Accident Prevention System on the Financial Supervisory Service's Fine consumer portal, which shares registered information with financial companies in real time and blocks new accounts and credit cards opened in the person's name.

Anyone who suspects fraud can seek advice from the National Police Agency's integrated response center for telecommunications-based financial fraud at 1394. Those who have already transferred money should immediately call police at 112 or their financial company's call center to request a suspension of payment.