Banks to tap telecom and investigative data in voice phishing detection

Banks will now be able to receive voice phishing suspicion data not only from financial institutions but also from telecommunications companies, virtual asset exchanges and investigative agencies, enabling them to take emergency action. With cross-sector data now available for analysis alongside financial information, the banking sector's voice phishing detection systems are expected to become significantly more sophisticated.

Amended versions of the Special Act on Prevention of Damage from Telecommunications-Based Financial Fraud and Refund of Damage and its enforcement decree took effect Tuesday, according to financial industry sources.

The ASAP system has operated on the basis of banking-sector data since October last year, but a lack of explicit legal grounds for information sharing limited participation mainly to financial institutions, preventing full use of data held by related agencies. Related ministries jointly drafted an amendment to the act establishing a legal basis for sharing financial, telecommunications and investigative suspicion data through ASAP. The amendment passed the National Assembly plenary session in January.

The amendment provides explicit legal grounds allowing financial companies, telecommunications firms, investigative agencies and other entities that supply voice phishing suspicion data to share that information with ASAP without obtaining individual consent from the data subjects.

Institutions designated under the law as eligible for information sharing include financial companies, telecommunications service providers, investigative agencies, the Financial Supervisory Service, the Korea Financial Intelligence Unit (KoFIU), electronic financial service providers (including prepaid service operators), virtual asset exchanges and the Korea Information and Communication Promotion Association.

The amended law goes beyond one-way submission of suspicion data by financial companies, telecoms and investigative agencies. It also allows those institutions to receive data shared by other agencies and analysis produced by the information-sharing and analysis organization, and to use that information for purposes such as the emergency blocking of crime-linked phone numbers and criminal investigations.

Information shared among institutions through ASAP includes account numbers, transaction records and account holder details linked to fraud-victim accounts, fraud-use accounts and fraud-related suspicious accounts; phone numbers suspected of being used in voice phishing and related user information; and suspicious-transaction detection data held by individual financial companies.

To enable swift information sharing among institutions, the amendment also establishes explicit grounds for setting aside restrictions imposed by laws such as the Real Name Financial Transactions Act and the Credit Information Act, securing a stable legal foundation for the system.

The Financial Services Commission reviewed applications from candidates seeking designation as the information-sharing and analysis organization under the amended law. It designated the Korea Financial Security Institute as ASAP.

With banks now able to receive telecommunications data and various investigative data on top of existing financial information, their in-house voice phishing detection systems are expected to advance considerably. Banks have been particularly welcoming of access to investigative agencies' data on malicious apps.

Financial authorities are also pushing a measure that would require financial companies to temporarily freeze accounts linked to investment advisory chat room scams and romance scams, treating them on a par with voice phishing crimes.

A Financial Services Commission official said the commission would "combine suspicious-transaction data held by financial institutions with telecommunications and investigative information through flexible and efficient information sharing among related agencies, and move more proactively to prevent crime — including through account suspension — while continuously monitoring ASAP operations and advancing the system through AI-powered pattern analysis and other enhancements without delay."