Banks face full liability for voice phishing compensation

Financial Services Commission Chairman Lee Eog-weon responds to a lawmaker's question during a plenary meeting of the National Assembly's National Policy Committee in Seoul, Wednesday. Yonhap

Financial authorities have taken a concrete step toward introducing a long-discussed no-fault compensation scheme for victims of voice phishing, submitting to lawmakers a blueprint that would require banks to reimburse losses unless they can demonstrate that a statutory exemption applies.

The proposal, included in the Financial Services Commission’s (FSC) policy report submitted Wednesday to the National Assembly, marks the government’s clearest signal yet that it intends to press ahead with revisions to the Special Act on the Telecommunications-based Financial Fraud and Refund for Loss after months of debate.

Under the plan, the bank used by the victim and the institution that maintained the fraudulent account would each bear half of the compensation paid to scam victims.

Instead of setting a fixed compensation limit, the revised legislation would authorize the state to determine the cap by presidential decree within a range of 10 million won ($6,890) to 50 million won. The formula for calculating each institution’s share of compensation, along with claims procedures and other operational details, would be set out in subordinate regulations.

The move comes as telecommunications-based financial fraud cases continue to increase. Losses climbed 14.1 percent from a year earlier to 433.8 billion won in 2025, the highest level in five years, according to the Financial Supervisory Service.

Banks would not be automatically liable in every case. Compensation could be reduced or denied if customers are found to have acted negligently or knowingly participated in the fraud, including instances in which they proceeded with a transfer despite repeated warnings that it could be part of a voice phishing scam.

However, the proposal reverses the current burden of proof. Rather than requiring victims to show that a financial institution failed to meet its duty of care, banks seeking to avoid liability would have to demonstrate that a customer was negligent or otherwise falls within one of the statutory exemptions.

Ahead of the proposed overhaul, banks have already been stepping up their anti-fraud efforts, investing in artificial intelligence (AI)-powered fraud detection systems while offering their own insurance products that compensate customers for phishing-related losses.

The policies typically reimburse up to 70 percent of losses, subject to a maximum payout of 10 million won — a level the industry views as more financially sustainable than the broader compensation obligations envisaged under the proposed legislation.

Banks argue that the no-fault compensation scheme goes well beyond those existing safeguards by substantially expanding lenders’ financial exposure.

"While we support the goal of strengthening protection for victims, shifting the burden of proof to institutions places a disproportionate burden on lenders. In practice, banks would have little choice but to tighten controls on non-face-to-face transfers in order to qualify for exemptions, which could ultimately make banking less convenient for customers," an industry official said.

The industry also warns that guaranteeing compensation regardless of a bank's preventive efforts could encourage moral hazard and fraudulent claims.

"Telecommunications-based financial fraud originates on telecom networks, yet telecom operators — arguably one of the key stakeholders — are largely absent from the current framework," the official said. "Much will depend on detailed implementing rules, including how liability is apportioned, when exemptions apply and how recovered funds are handled."

To ensure victims receive compensation promptly, the process may be better administered through an independent compensation fund rather than requiring individual financial institutions to determine liability on a case-by-case basis, he added.