KB Kookmin Card Co. said it will enforce stricter daily overseas contactless spending caps and default-on fraud alerts through Chuseok after a phishing wave tricked cardholders into revealing credentials ahead of holiday travel bookings. The issuer keeps higher limits for chip-and-PIN and biometric wallet payments while throttling no-PIN tap rails that fraud rings exploited in relay tests at overseas transit retail lanes.
Phishing wave mechanics
Korea Internet & Security Agency bulletins this month documented SMS and Kakao-linked messages posing as airlines, duty-free operators, and parcel services, sending victims to fake login pages that harvested card numbers and one-time passwords. Criminals then ran rapid contactless charges in Europe and Southeast Asia before victims noticed push notifications delayed by do-not-disturb settings during Chuseok family gatherings.
KB’s fraud unit tied many cases to premium cards held by retirees planning overseas family visits or Jeju packages; average loss per incident rose versus summer because holiday baskets were larger. Phishing volume spiked after legitimate carriers sent real schedule changes, making fake duplicates harder to spot.
What caps change now
Overseas contactless daily totals drop to a ceiling KB mailed to affected product tiers, with automatic blocks when cumulative tap spend crosses thresholds in merchant local time. Chip-and-PIN purchases, ATM withdrawals with PIN, and tokenized wallet taps that require fingerprint or face unlock remain at prior limits—a distinction call-center scripts repeat because customers conflate “contactless” with all card-not-present spend.
Domestic tap rules are unchanged; the holiday program runs through October 5 with weekly review. KB enables SMS and app push for every overseas authorization unless cardholders opt out in writing, reversing earlier marketing that treated alerts as premium friction.
Chuseok travel timing
Airport duty-free concourses peak before outbound flights Wednesday and Thursday; fraud teams staff Incheon and Gimpo hotlines with English support. KB partnered with airport police to poster examples of fake QR payment stickers—separate from Financial Supervisory Service highway warnings but part of the same holiday scam season.
Families booking group trips should align card limits with preordered gift sets; contactless speed matters in transit zones, but PIN fallback remains available at cosmetics counters accustomed to high-value baskets.
Regulatory backdrop
Financial Supervisory Service guidance expects issuers to mitigate overseas fraud spikes without age-discriminatory marketing while still tailoring safety tools. KB’s notices use large-type app banners and branch FAQ sheets; consumer groups asked for clearer mapping between contactless blocks and legitimate wallet apps—KB added color-coded transaction labels in its September app update.
Shinhan and Woori tightened overlapping products earlier; KB’s Chuseok package is time-bound but could become permanent if loss rates fall.
Customer remediation
Victims who report phishing within 24 hours retain chargeback rights under Korean electronic finance rules if they did not grossly negligence-share PINs; KB waives contactless cap lift fees for verified fraud cases. Temporary limit increases require voice biometrics plus a cooling hour to block impulsive lifts requested by scammers on the phone.
KB recommends disabling contactless in the app when not shopping, using hotel safes, and verifying carrier URLs from official apps rather than SMS links—a tedious habit banks now push as hard as rewards points.
Merchant and partner impact
Duty-free operators worry slower taps lengthen queues; KB said PIN-trained staff at partner stores can override delays with manual imprinters on rare legacy terminals. Wallet apps linked to KB cards count as authenticated spend outside the contactless cap when tokenization meets FSS standards.
Travel insurers tied to KB cards confirmed fraud coverage remains if reports are prompt; caps alone do not void policies.
After the holiday
KB will publish aggregated fraud statistics without customer identifiers and decide whether caps persist into winter ski season, another peak for overseas tap fraud. For Chuseok travelers, the trade is explicit: slightly slower checkout beats disputing five-figure phantom taps from a highway rest stop Wi-Fi click.