KISA blocked 41,200 smishing domains that impersonated Hana Bank holiday notices, the largest single-week takedown the agency has reported since it centralized DNS flagging for financial phishing in 2024.
The Korea Internet & Security Agency said most domains went live between October 3 and October 9, when lenders sent Chuseok account alerts. Criminal clusters copied Hana’s green header graphics and Korean subject lines promising “fee refunds” if users tapped a link and entered card numbers. KISA synchronized blocks with major mobile carriers and three domestic certificate authorities so revived subdomains could not quickly obtain TLS seals.
How the campaign worked
Investigators traced registration patterns to bulletproof hosting in Southeast Asia with fast-flux DNS. Victims received SMS messages that displayed “HanaBank” in the sender field using alphanumeric spoofing allowed on legacy SMS gateways. Clicking through landed on a one-page form that harvested login credentials and one-time passwords relayed to call centers in Incheon and Manila, police said in a joint briefing Monday.
The National Police Agency arrested 14 low-level “voice phishing typists” over the weekend, but command nodes appear offshore. KISA emphasized domain blocks because Korean banks cannot freeze overseas hosts directly; cutting resolution starves the funnel even when sites reappear under new names.
Bank and regulator response
Hana Financial Group pushed an in-app banner warning customers that legitimate holiday messages never ask for full card numbers. It also throttled SMS marketing temporarily so fraud texts would stand out less beside authentic traffic. The Financial Supervisory Service reminded institutions to adopt the “#안심” sender registry for official texts, a voluntary branding program that Hana joined last year but that scammers can still mimic visually.
KISA plans to share YARA-style rules with smaller savings banks that lack in-house threat teams. The agency’s director general for cyber response said holiday-themed lures appear within hours of any major lender announcement, suggesting automated scraping of public press releases.
What users should do
Official guidance unchanged: open the bank app directly or call the number on your card back, not the SMS link. Android users with carrier spam filters saw a 37 percent drop in delivered Hana-themed smishing after Monday’s blocklist update, according to SK Telecom’s transparency report, but iMessage and over-the-top chat apps are not covered.
Consumer groups asked parliament to pass pending legislation fining telcos that fail to authenticate commercial SMS headers. The bill stalled in committee before Chuseok; sponsors vowed to reintroduce it this month citing KISA’s statistics in committee hearings.
Broader threat picture
The Hana wave followed a smaller clipboard-malware campaign targeting brokerages earlier in October, showing fraudsters rotating between investment and retail banking brands. KISA said total financial phishing domains blocked in 2026 surpassed 300,000, already above the full-year 2025 tally.
For Seoul commuters deleting another fake refund text, the takedown is invisible but necessary. For policymakers, the numbers are a reminder that Korea’s mobile-first banking culture remains a high-value target every long weekend.