Voice phishing via mobile payment apps tops 3,273 payment suspensions at major banks

The five largest South Korean banks suspended more than 3,000 accounts in the first half of this year tied to voice phishing losses channeled through mobile payment services such as Kakao Pay, Naver Pay and Toss. The number of suspensions more than tripled from a year earlier, even as the average loss per case fell — a pattern regulators are calling a shift toward smaller, more frequent fraud.

Data submitted by the Financial Supervisory Service to People Power Party lawmaker Seo Il-jun's office show that KB Kookmin, Shinhan, Woori, Hana and NH NongHyup Bank together suspended 3,273 accounts in the first half of this year in connection with voice phishing funds routed through prepaid payment services operated by Kakao Pay, Naver Pay and Toss.

That figure represents a 247 percent increase from the 943 suspensions recorded in the first half of last year. The first-half total alone already exceeds the full-year suspension count of 3,146 for all of last year.

Although the number of cases rose sharply, the amount lost per incident shrank. Total fraud proceeds deposited through mobile payment channels reached 3.59 billion won ($2.68 million) in the first half of this year, up 19 percent from 3.02 billion won in the same period last year. The average loss per case fell from 3.21 million won to 1.1 million won — roughly one-third of the earlier level.

The trend reflects the structural features of mobile payment services, which allow users to transfer funds through simple authentication such as passwords or biometric recognition. Unlike direct bank-to-bank transfers, these services move prepaid balances between accounts held at payment companies, which historically made it difficult for banks to track fund flows within the mobile payment system in real time.

However, a 2024 amendment to the enforcement decree of the Act on Special Cases Concerning the Return of Damage Caused by Telecommunications-Based Financial Fraud made information sharing between financial institutions and prepaid service providers mandatory, enabling banks to freeze funds linked to voice phishing even after they pass through mobile payment channels. If fraud proceeds remain in a prepaid balance, the payment company freezes the linked master account. If the funds have already moved to another bank account, the bank receiving notification from the payment company freezes that account.

Cases in which fraud proceeds remained in a prepaid balance — triggering a freeze on the master account — also increased. In the first half of this year, 324 such cases were recorded, with losses totaling 284.67 million won, up 85 percent and 51 percent, respectively, from the same period last year. The average loss per case fell from 1.08 million won to 880,000 won.

Among payment platforms, Kakao Pay accounted for the largest share. Of the 7,312 payment suspensions at the five major banks between September 2024 and June this year, 4,336 — or 59 percent — involved funds routed through Kakao Pay. By value, Kakao Pay's share was 79 percent.

Naver Pay recorded 698 payment suspensions in the first half of this year, already surpassing its full-year total of 534 for last year. Toss logged 696 suspensions in the same period, with fraud losses of 890 million won — increases of 154 percent and 106 percent, respectively, from the first half of last year.

Financial regulators plan to upgrade their AI-based information-sharing and analysis platform, known as ASAP, along with their abnormal financial transaction detection system to strengthen monitoring of suspicious activity within mobile payment flows.

Meanwhile, regulators are also reviewing measures to strengthen the liability of financial institutions and telecommunications companies in compensating voice phishing victims. Financial Services Commission Chairman Lee Eok-won told the National Assembly's Political Affairs Committee during a national audit on Thursday that he would consider designing a no-fault liability framework to ensure financial and telecom companies bear greater preventive responsibility.