The Korea Internet & Security Agency issued a phishing advisory warning that criminal groups are exploiting recent financial-sector data breaches with text messages promising leak compensation or low-interest relief loans.
How the scheme works
KISA's Protect & Safety Bureau said attackers blast smishing notes with keywords such as "personal information leak" or "damage payment." Links route victims to fake portals that harvest login credentials or push malicious apps. Some callers impersonate bank staff and demand installation of remote-access software, a classic voice-phishing twist on the same theme.
Search-engine ads can also surface look-alike sites when users hunt for breach updates, the agency added.
Official response period
The Financial Services Commission and Financial Supervisory Service declared a one-month "special response period" starting October 6, asking banks to run dedicated hotlines and tighten illicit schemes-detection monitoring on high-risk transfers. Authorities said they had not confirmed financial losses from leaked credentials as of the alert, but expect phishing volume to rise.
What to do
KISA tells recipients to delete suspicious texts, verify claims through official apps, and use its KakaoTalk "Protect & Safety" channel to check URLs. No government agency or bank will request passwords, one-time codes, or remote app installs by SMS.
Voice and search vectors
Beyond SMS, KISA warned that voice phishers may reference the same breach headlines to sound credible. Callers sometimes read partial account digits leaked from unrelated databases, a tactic that convinces victims the caller already has their file.
Poisoned search ads remain lucrative because nervous customers google "compensation" plus a bank name minutes after news breaks. KISA asked portals to accelerate takedowns, but users should treat sponsored links skeptically during breach news cycles.
Corporate obligations
Financial firms must operate dedicated hotlines during the FSC's special response month and report suspected illicit schemes within hours. The ASAP platform has already shared hundreds of thousands of suspicious transaction flags since launching in late 2025, preventing hundreds of billions of won in losses, according to regulator slides.
KISA's Kakao channel can check URLs without installing new apps, a low-friction step that blocks many smishing links before credentials are entered.