The Korea Internet and Security Agency told certified open-API operators this week that outbound invoice and payment-status webhooks must carry HMAC signatures and replay-resistant timestamps starting 1 March 2027, a mandate written after investigators traced more than 4,200 forged callback events this summer to middle-tier aggregators that never verified sender keys.
What broke
Attackers registered look-alike merchant domains, pulled legitimate National Tax Service e-invoice metadata through partner portals, then pushed fake “paid” webhooks into accounting SaaS stacks. Small manufacturers in Gyeonggi and Daegu saw payroll accounts drained when auto-reconciliation tools released supplier batches before humans opened the tax portal. KISA’s incident tally counts 38 billion won in attempted transfers, with banks stopping roughly two-thirds at the wire desk.
Unlike phishing that targets login cookies, the fraud chain exploited trust in machine-to-machine pipes fintechs marketed as “real-time VAT matching.” Middleware vendors often forwarded JSON payloads without checking whether the signing secret rotated after a breach, investigators said in a briefing note circulated to certified providers.
What KISA is ordering
Under the revised Open API Security Guide, every webhook must include a keyed hash using secrets issued through KISA’s certification registry, plus a monotonic event identifier stored for seven days to block replays. Providers must publish verification libraries in Java and Node by December and complete penetration retests before the March deadline. Non-certified integrators may still operate domestically but cannot display the agency’s trust mark or connect to KFTC’s instant settlement rails.
KISA officials stressed the rule applies to invoice status, not consumer-facing payment buttons already governed by Financial Services Commission strong-customer-authentication rules. The split matters for ERP vendors that assumed VAT callbacks were “back-office” traffic exempt from earlier signing requirements.
Who carries liability
Legal teams at three listed fintechs told InfoHandle that contracts will shift breach notification duties upstream to aggregators that fail signature checks. The Personal Information Protection Commission has opened a parallel review of whether forged callbacks constitute unauthorized processing of business registration numbers; a guidance letter is expected before Chuseok.
Banks said they will not refund firms that ignored dual-control settings once signatures become mandatory. Shinhan and Woori both reminded corporate clients that webhook-driven releases still require secondary approval on transfers above 50 million won.
Vendor scramble
Mid-sized API gateways in Pangyo said backlog for retesting tripled after the announcement. Several plan staged rollouts: sandbox signatures in November, production keys in January, with read-only monitoring weeks where mismatched hashes trigger alerts but do not block traffic. Accounting SaaS firms asked KISA for grace on legacy on-prem installs that cannot load new crypto libraries without Windows Server upgrades.
What SMEs should do now
KISA recommends disabling auto-pay rules tied solely to webhook success flags until providers attest compliance. Tax agents urged firms to reconcile against the NTS portal nightly during the transition and to store webhook secrets in hardware security modules where possible. Training slides distributed to regional SMB centers walk bookkeepers through spotting duplicate event IDs—a telltale sign of replay attempts during pilot attacks in July.
Timeline and politics
The National Assembly’s Science and ICT Committee scheduled a September hearing on open-API fraud after opposition lawmakers cited the invoice case as proof self-regulation failed. Government officials defended the March date as realistic for certified vendors while leaving room to pull forward the deadline if holiday-season fraud spikes. For now, the agency is betting that mandatory signing is cheaper than insuring every forged callback across Korea’s SME manufacturing base.
International read-through
Korean invoice middleware exports to Vietnam and Indonesia; those partners asked whether Seoul will mutualize signature keys across borders. KISA said cross-border recognition is out of scope for March, pushing multinationals to run separate verification stacks per jurisdiction—a compliance cost finance chiefs at Busan exporters said they had not budgeted for 2027.
Audit expectations
External auditors reviewing listed fintechs told InfoHandle they will sample webhook logs during year-end reviews starting in 2026 even before the mandate bites, looking for unsigned events as a control deficiency. KISA published a checklist for CIOs covering key rotation, clock skew tolerance, and incident reporting within 24 hours—details that sound procedural until a forged callback shows up in a quarterly filing.
For family-owned factories still running desktop accounting tools, regional tax offices plan Saturday clinics in September to walk owners through dual approval settings. The agency’s message is blunt: signatures fix the pipe, but humans still own the button that sends payroll.
