Hana Card will require smartphone two-factor approval before a card on file can start a new online subscription, a change the issuer said will roll out to all personal cards by November 3 after prosecutors mapped a fraud pattern that began with 1,000-won trial charges on stolen credentials.
The rule targets first-time recurring payments at streaming services, cloud storage vendors, and mobile game portals—merchants that store card tokens for monthly billing. When a subscriber adds a Hana Card, the Hana Members app will push a one-time approval that must be completed within five minutes or the merchant receives a soft decline.
How the scam worked
Seoul Central District Prosecutors said last week that a ring tested stolen card numbers with sub-1,500-won charges across 38 merchants before flipping active tokens to resale markets. Because many subscription platforms only verify micro-payments once, victims did not notice until larger digital goods purchases posted days later.
Hana’s fraud team said internal data show subscription-token abuse rose 27 percent year on year in the third quarter, faster than overall card fraud. The Financial Supervisory Service had already urged issuers to tighten card-on-file controls after a separate AI-linked data breach at a payment gateway in September.
Merchant and customer impact
Major domestic streaming platforms told the Korea Financial Telecommunications & Clearings Institute they can accept the extra step without breaking checkout flows, because token creation already routes through 3-D Secure for many Hana transactions. Foreign merchants using cross-border billing aggregators may see slightly higher abandonment on the first charge, Hana warned in a merchant bulletin.
Cardholders can whitelist up to five merchants—useful for families that rotate Netflix or YouTube accounts—after completing the initial approval. Lost-phone scenarios fall back to ARS verification with voice biometrics Hana deployed earlier this year.
Industry follow-through
Shinhan Card and KB Kookmin Card said they are reviewing similar controls but have not set dates. The FSS plans to publish nonbinding guidelines in December on subscription fraud, including recommended velocity limits on micro-charges from the same IP block.
For Hana customers, the practical effect is an extra tap when signing up for a new service, not when monthly renewals post. The issuer hopes that friction is small compared with disputing a stolen card number that fraudsters already weaponized across a dozen silent subscriptions.
Timeline for cardholders
Hana will push an app update on October 28 that enables the approval screen, with SMS fallback for customers who have not migrated off legacy plastic-only cards. Merchant acquirers must certify their billing gateways by November 1 or face soft declines on first-time subscription charges.
Industry groups and regulators said they will publish follow-up guidance within two weeks, giving banks, shippers, and clinics time to adjust internal checklists before year-end audits. Consumer advocates asked for plain-language summaries on issuer websites so cardholders and patients understand what changes on their next statement or visit.
Analysts covering the sector said the announcement fits a broader pattern of tighter operational rules after a string of high-profile compliance and safety cases this autumn. Whether the move shifts fundamentals or simply clears near-term compliance backlogs will depend on enforcement data due out in January.