South Korea's Financial Services Commission said on Thursday that 37 financial companies reported 40 hacking incidents between Sept. 30 and Nov. 3, exposing about 473,000 records, and set out new inspections, fraud monitoring and a push for a law that would make lenders pay voice phishing victims regardless of fault.

The breaches hit four banks, five securities and investment firms, three insurers, five savings banks, ten electronic payment companies, three virtual asset service providers, four peer-to-peer lenders and others, the regulator said after a Nov. 5 meeting with ministries and industry groups. Most of the leaked data concerned employees, but customer names, resident registration numbers and account numbers were also taken. No account passwords have been reported stolen.

For South Korean savers, the immediate risk is less a drained account than a better-informed scammer. A caller who already knows a victim's name, ID number and bank account sounds far more like a real bank employee. That is why the commission's package leans heavily on stopping what it calls secondary damage, and on shifting the cost of phishing losses from customers to financial companies.

What the FSC says has been lost so far

Some smaller firms in the virtual asset, electronic payment and peer-to-peer lending sectors lost a combined total of about 1 billion won, the FSC said. The money came mostly from the companies' own management accounts, and no individual user losses had been found as of the meeting.

The regulator pointed to two existing protections. The Electronic Financial Transactions Act already makes financial companies strictly liable for certain unauthorized electronic transactions, and the Act on the Protection of Virtual Asset Users requires crypto platforms to hold insurance and reserves. The FSC and the Financial Supervisory Service said they would supervise the affected firms closely to make sure customers are covered.

Inspections start immediately. Authorities will examine the external access points, such as application programming interfaces, of about 580 businesses across banking and nonbank finance, finishing by the end of November. A review of internal controls, including the duties of chief executives and chief information security officers, will run to the end of the year. Firms found to have weak spots have been told to suspend the affected service and cut off outside access at once.

Large firms will also face third-party vulnerability checks twice a year instead of once, with rule changes sought this month. A shared hacking-alert system run by the FSS, known as FIRST, will start a pilot in December and extend to all financial sectors in the first quarter of 2027. Crypto exchanges, which now report hacks only to the Korea Internet & Security Agency, will be told to report straight to financial regulators under guidelines due in November.

Phishing index and no-fault compensation for Korean bank customers

The measures that matter most to ordinary depositors concern voice phishing. The FSC said it will add an AI-driven "potential phishing index" to its anti-phishing data platform, ASAP, from November to help banks flag suspect transfers and freeze criminal accounts faster. Updated detection guidelines covering newer scam methods will apply to banks and nonbanks and be built into the platform by December. Regulators will also monitor dark web marketplaces around the clock for stolen financial data and move to block sites selling it.

The commission said it will actively support a pending revision of the Special Act on the Prevention of Telecommunications-based Financial Fraud and Refund for Loss, which would write strict liability for voice phishing losses into law. It also said it will consider making telecom carriers bear some responsibility.

The proposal, first sent to the National Assembly in July, would require banks to repay victims unless they can prove a statutory exemption applies, The Korea Times reported at the time. The victim's bank and the institution holding the fraudster's account would each pay half. A presidential decree would set the cap at between 10 million won and 50 million won per case, and payouts could be cut or refused if a customer was negligent or kept transferring money after repeated warnings.

That compares with bank phishing insurance policies that typically cover up to 70% of a loss with a 10 million won maximum, the newspaper said. Telecom-based financial fraud losses rose 14.1% in 2025 to 433.8 billion won, the highest in five years, according to Financial Supervisory Service data cited by The Korea Times.

The FSC has estimated annual payouts under the new regime at up to 281.1 billion won with a 50 million won cap, or 109.8 billion won with a 10 million won cap, Insurance Business Asia reported in September. Two bills containing the no-fault measure were pending in the legislature at that point.

Korea would join other Asian markets moving the burden of scam losses toward lenders. In India, the Supreme Court said on Oct. 29 that banks should repay fraud victims when their own due diligence fails.

What customers can do now

Until the law changes, Korean bank customers who suspect their data was exposed should treat any unsolicited call citing their account or ID details with suspicion, and confirm through the bank's official number before moving money. The FSC's own timeline sets the next checkpoints: inspection results on external access points by the end of November, the expanded phishing guidelines by December, and a separate digital finance safety bill, covering crypto platforms and outside data processors, in the first quarter of 2027.