Shinhan Card imposed a same-session ATM withdrawal ceiling in Cambodia on Friday after the Korea Financial Intelligence Unit linked a jump in cash-out patterns to voice-phishing crews targeting Korean tourists during the long holiday travel week.
What cardholders see in the app
Push notices sent overnight told customers that ATM withdrawals in Cambodia would be limited to 300,000 won per calendar day until further review, while point-of-sale limits stayed unchanged. The bank said the move is temporary and aligned with KoFIU red-flag thresholds on rapid cross-border cash cycles that do not match hotel or airline merchant codes.
Why Cambodia surfaced in the data
Phnom Penh and Siem Reap saw a cluster of withdrawals followed within hours by wire transfers to third-party accounts in Korea, a pattern KoFIU briefed card issuers on Thursday. Unlike earlier China ATM scams, the Cambodia spike coincided with direct flights resuming after Chuseok, when families travel on packaged tours. Police cyber units said callers impersonating prosecutors still dominate domestic losses, but overseas ATM cash remains a laundering step because it bypasses merchant chargeback rules.
Competitive response from other issuers
KB Kookmin and Hana Card told InfoHandle they are monitoring KoFIU dashboards but have not matched Shinhan's hard cap. Industry groups warn that uneven limits confuse travelers who carry multiple wallets. Credit-card marketers had promoted overseas fee holidays for October; risk officers now weigh promotion burn against fraud spikes.
Consumer steps
Travelers should set geo-alerts, carry two-factor enabled apps, and avoid installing remote-access software when callers claim customs holds. Shinhan said customers with pre-registered business travel can request whitelist reviews through branch video calls. Regulators may publish a joint bulletin if other Southeast Asian corridors show the same fingerprint next week.
For Seoul households, the limit is inconvenient but narrower than a full country block some banks used during past scam waves. It signals that holiday travel and fraud analytics now move on the same calendar as Kospi holiday sessions.
Cross-border coordination
KoFIU shared typology sheets with Cambodian central bank contacts through the Egmont Group channel, focusing on mule accounts that receive ATM cash within minutes of withdrawal. Shinhan's limit is one lever; law enforcement wants camera footage from partner ATMs when Korean cards spike. Tourism ministry officials worry the headline could chill October package sales unless embassies publish safety guides alongside bank notices.
Card networks said they are testing merchant-category velocity rules that flag when a card withdraws cash then immediately buys jewelry or electronics, a pattern seen in earlier Vietnam scams. None of those rules are live in Cambodia yet, which is why issuer-level caps came first.
Holiday travel patterns
Airport duty-free preorders showed Cambodia as a top-five short-haul destination for Korean families this October, which is why a Friday limit landed before Sunday departures. Travel insurers added optional fraud riders but said uptake stayed below ten percent. Card issuers debated whether to push travel-mode toggles that require in-app confirmation before any overseas ATM use, a feature Samsung Pay pilots with two banks next quarter.
Embassy consular staff in Phnom Penh posted Korean-language guidance on verified social accounts, steering victims to local police stations that accept interpreter services. The diplomatic note does not replace issuer controls, but it reduces panic calls when limits trigger mid-trip.