Shinhan Card lowered single-session ATM withdrawal limits in Cambodia for most debit and credit products after the Financial Intelligence Unit linked a cluster of Phnom Penh cash-out points to voice-phishing rings targeting Korean retirees. The change took effect Friday, the first Hangul Day holiday session when call-center fraud teams are thinly staffed but overseas travel cash demand remains high.
Customers with pre-registered travel notices can still withdraw, but daily ceilings drop to the equivalent of 700,000 won per card unless branch managers approve a higher tier with documented itineraries. Hana Card said it is reviewing similar caps but has not changed limits yet.
What KoFIU saw
A KoFIU bulletin described mule accounts receiving won transfers from compromised Korean banking credentials, then converting funds through Cambodian payment aggregators that route to ATM networks near airport hotels. Investigators counted 312 suspicious remittance paths in September, up from August, with weekend spikes matching phishing SMS blasts in Korean.
The unit did not accuse Shinhan of wrongdoing; it asked issuers to tighten geofenced limits where BIN routing is opaque. Consumer advocates welcomed the cap but said issuers should push real-time SMS alerts in Khmer-translated templates for family travelers.
Cardholder friction
Travel agencies reported last-minute calls from golf groups in Siem Reap asking whether corporate cards are exempt. Shinhan’s FAQ says corporate travel cards follow separate risk tiers, but small-business owners on personal products face the new ceiling immediately.
Credit-card marketers had been promoting overseas cashback for October; Shinhan said those promotions remain, with fraud education banners added in apps. Rivals worry that uneven limits could push fraudsters toward less restricted BINs, a cat-and-mouse game regulators expect to continue through Chuseok return traffic.
Broader FSC context
The move sits inside a month-long caution-level cyber alert after credential dumps followed a recruiter-portal blackout. Shinhan’s limit is a product control, not a capital measure, yet it shows how payment risk now travels with tourists even when Seoul’s stock market is closed for Hangul Day.
Regional coordination
Thai and Vietnamese issuers said they are watching Shinhan’s move but have not matched limits yet. ASEAN bankers forum calls scheduled for late October may produce a shared travel-fraud playbook.
Korean embassy consular staff posted ATM safety tips in Khmer on social channels, emphasizing that lower limits do not block emergency medical withdrawals with documentation.
Desk notes
Traders and officials interviewed Friday said the Hangul Day calendar compresses decisions that normally spread across two cash sessions, making derivatives and policy announcements louder than usual. Several sources asked not to be named because their institutions bar holiday comments to media.
Consumer groups urged clearer app disclosures before Tuesday’s Kospi reopen, when portfolio screens will jump from frozen marks to live auction prints. Schools reopening next week add another layer of flu and travel risk that intersects with the policy moves described above.