Korea Internet & Security Agency officials urged the public to delete text messages promising disaster compensation or card-refund credits, warning that criminals are exploiting headlines from the Bucheon metal-coating plant fire and recent financial-sector data breaches.
The alert, amplified through local broadcasters Friday, comes days after five firefighters were injured battling the Bucheon blaze and investigators found roughly 180 chemical containers at a site that lacked hazardous-materials permits. Phishing operators often tailor lures to breaking-news keywords, hoping victims click before government guidance catches up.
How the lures work
Typical messages claim to be from insurers, city disaster offices, or card companies, offering expedited payouts if the recipient verifies bank details. KISA reminded users that legitimate agencies do not request account passwords or one-time codes over SMS. Any link shortening to an unfamiliar domain should be reported through the agency's 118 phishing hotline.
The timing overlaps with broader anxiety about consumer data after payment-platform incidents earlier in the month. Even households unaffected by the fire may receive identical templates because fraudsters blast entire number ranges.
Fire-site context
Gyeonggi Province fire officials said the Bucheon factory had no record of hazardous-chemical handling licenses, raising questions about how flammable coatings were stored indoors. Environmental teams were still cataloging drum contents late in the week, a process that will take days—not the minutes implied by fake refund texts.
President Lee Jae Myung ordered an all-out response from safety ministries after the injuries, but no official compensation portal has been announced for nearby residents. Anyone promising instant wire transfers is impersonating the government.
Protective steps
KISA advised updating mobile operating systems, enabling carrier spam filters, and confirming disaster aid only through city hall phone numbers listed on official websites. Businesses should warn employees who work near industrial zones, because attackers also send workplace-themed phishing during high-profile incidents.
With the Kospi swinging sharply this week, fraudsters have added investment-recovery pitches alongside disaster templates. Treat both as the same threat: unsolicited links that arrive when headlines are hot and defenses are low.
Telecom carriers SK Telecom, KT, and LG Uplus have expanded SMS filtering models this year, yet attackers rotate domains faster than blocklists update. KISA's guidance urges reporting numbers to help train those filters, even when no money is lost.
Employers near the Bucheon industrial zone should post Korean-language and migrant-worker notices in break rooms, because warehouse staff often use personal phones for shift swaps and are prime targets for fake payroll texts.
Insurance regulators separately warned life insurers not to cold-call policyholders about fire compensation, reinforcing that any legitimate outreach will reference an existing claim number. Cross-checking that number on the insurer's official app remains the safest verification step.