War on voice phishing: Inside Shinhan Bank's consumer protection unit
"You're being told to send the money. We're telling you not to. So who should you trust?"
On Tuesday afternoon at Shinhan Bank's headquarters in Jung-gu, Seoul, a group of employees work through insults without ever hanging up the phone. They are the bank's consumer protection unit — staff who monitor suspicious transactions in real time. When something on their screens catches their eye, they pick up the phone. "Why did you suddenly send the full 20 million won ($14,100) from the business loan you took out today?" "That person is a member of a voice-phishing ring. Trust us — stop taking their calls." Voices overlapped across the floor.
This reporter observed the unit's daytime monitoring operations on Tuesday and Friday, following the process from the detection of a suspicious transaction to the prevention of actual financial harm. After completing a customer data security briefing, calls between staff and customers were monitored in real time through an earpiece connected to the handset. Staff names have been withheld throughout this article to prevent their identities from being exposed and exploited in crimes such as bank employee impersonation.
A team of banks races after 20 million won — At 3:48 p.m. Tuesday, a shout came from a neighboring desk: "B credit union is calling to check on a customer's account." Team leader O, a seven-year veteran, reached over and took the call. He quickly scanned the transaction history. A Shinhan Bank customer had taken out a 20 million won business loan that day and immediately transferred the full amount to an account at Bank A; the money had then moved again to an account at B credit union. One account to another, then on to yet another institution — the flow made no sense.
"This is Shinhan Bank headquarters. You sent 20 million won from your loan today — can you tell us why?" "Payment for goods." "What kind of goods?" "A sterilizer." "Did you send the money before receiving the item?" "Yes — they said payment had to come first before they'd ship it." O grabbed his head for a moment. Something had clicked. "Who contacted you about this?" The customer named a plausible-sounding medical public institution. The moment he heard it, O cut in: "Sir, this is a scam. A no-show fraud."
It was a textbook no-show fraud. A growing wave of such schemes involves criminals impersonating public institutions or medical foundations and asking small-business owners to pre-pay for goods on their behalf, promising a large contract in return. The victims wire their own money, believing they have landed a major deal — but both the order and the company they were referred to are fake. O's words came faster. He pulled out a sheet of paper from under his desk, densely filled with the phone numbers of other banks' call centers. "Call Bank A and report this as a no-show fraud involving public institution impersonation. Ask them to freeze that account. And you need to file a police report right away."
O pushed the original victim to file a report quickly; Bank A traced the movement of funds through the intermediate account; and B credit union managed to hold the 20 million won before it could be withdrawn. The account holder at B credit union — suspected of being a fraud account — was apparently in the middle of protesting loudly that the money had been frozen without warning. The freeze held regardless. Shortly after, the victim called back, relieved to learn the money had been stopped, and kept repeating, "Thank you."
Voice phishing is a race against time. Hesitate for a moment and the money scatters across more accounts. But move too fast and a legitimate transaction could be wrongly blocked. When the signs of fraud are strong enough, the unit temporarily restricts a transaction first and then works to persuade the customer — asking why the money was sent, tracking where the funds in the recipient account are moving, and if necessary, asking the customer to come into a branch in person.
Even then, some customers refuse to believe it. Only when a uniformed police officer appears in front of them do they finally accept that they have been defrauded. In a more recent tactic, phishing rings impersonating prosecutors and other authorities have begun isolating victims by keeping them alone in short-term rental accommodations, cutting them off from the outside world. Bank employees have increasingly had to call the police themselves to get victims out of those rooms.
A banker's quick thinking fools the phishing ring — When stolen funds arrive, the cash-out operatives move. Rather than transferring the money to another account or withdrawing it from an ATM, phishing rings have increasingly been converting the proceeds into gift cards. "People who've never made a transaction suddenly send 20 million, 30 million won," said senior officer G, pointing to a line on the monitoring screen. "And then the money immediately leaves at a mart." In the transaction log, 100 million won had flowed into multiple unrelated accounts in rapid succession, then drained away in intervals of 20 to 30 minutes — sometimes within seconds. Within an hour, 80 million won had been charged to a debit card at one mart. The pattern pointed to gift-card purchases.
Phishing rings have been particularly targeting low-credit borrowers by impersonating savings banks and other lenders, promising to arrange loans in exchange for help buying gift cards — and walking away with the victim's bank account and debit card. The account of someone who simply wanted a loan becomes, without their knowledge, a conduit account receiving money stolen from other voice-phishing victims. On Friday afternoon, G called the registered account holder of one such conduit account flagged for gift-card purchases and told them that remote transactions had been restricted because they had not visited a branch, and that they would need to come in person for any banking. "I was just doing what they told me to do — they said I'd get a loan!" came the raised voice on the other end of the line.
Such moments are rare, but there are times when stopping the damage demands quick thinking. Back in March, G was running through suspicious transactions as usual when a call to an account holder made his ears perk up. The man on the other end had mistaken the bank employee for a superior within his own criminal organization. He happened to be in the middle of meeting another operative to hand over gift cards.
'I can't let this slip.' The bank employee played along, asking in the tone of a superior: "Where are you?" "In front of O Mart. Are you nearby?" "Don't hand the envelope to the person in front of you. We're changing the operation point — move to the Shinhan Bank nearby." The employee's sole objective was to get the operative inside a Shinhan Bank branch before the gift cards could be passed on. "We have our people inside that branch," he added, making the teller sound like a planted member of the ring.
Three things happened at once: the monitoring officer played the superior, the branch teller kept the operative occupied without raising suspicion, and a third bank employee tracked down the gift-card victims and urged them to file reports. But the operative soon sensed something was wrong. He tried to bolt, and a physical struggle broke out between him and the teller. Police arrived at the scene and arrested him on the spot. The gift cards in his possession were seized, and he was later taken into custody.
A week of calls to turn a believer — What the unit has to stop is not only suspicious wire transfers. It also has to change the minds of people who have already been taken in. After a brief pause, O called back a customer he had flagged the previous week as a likely investment fraud victim. The customer had still not filed a report. Gently coaxed into talking, the customer said they had been trading crude oil futures and had been asked to put up 20 million won as a deposit. They had come across an investment video on YouTube, been contacted afterward, and found the trading platform they were shown convincing enough to start investing.
The problem was the account the money had been sent to. It had already been frozen following reports from other investment fraud victims. Even as O grew more direct — "That exchange is fake" — the customer remained skeptical, still insisting "I haven't lost anything yet." With the balance still showing on the fraudulent investment app, the customer did not see themselves as a victim. O pressed on: "Multiple fraud reports have already been filed against that account. They're telling you to send money. We're telling you not to. Who should you trust?"
O then walked the customer through the reporting process step by step: call the wire-transfer bank's customer service line to report the fraud, obtain a transaction record from the bank, then go to a police station. After giving a statement and receiving an official incident confirmation document, the customer could return to the bank to apply for a refund — at which point a reimbursement process would begin based on the frozen balance in the suspect account. Three days later, on Friday, O confirmed that the customer had actually completed the report before finally clicking the "case closed" button. One customer's monitoring case had taken nearly a week to resolve.
"It's not uncommon to spend several days persuading a single customer in order to stop one case," a consumer protection unit official said. The monitoring system typically flags around 400 suspicious transactions a day, reaching as many as 500 on busy days. Today, as every day, the calls keep coming — each one an effort to protect every last won of a customer's money.
forest@heraldcorp.com
