The Financial Supervisory Service is drafting carrier complaint escalation rules after investigators logged a cluster of voice-phishing cases in which victims proved OTP receipt on one mobile network while banks insisted transactions originated on freshly swapped SIMs.
Where the week broke
Card security units at two major card issuers said engineers posing as exchange security staff convinced holders to install remote-access tools, then triggered wire transfers once SMS one-time passwords arrived. When customers called carriers, helplines often treated the dispute as a billing issue; when they called banks, security desks asked for carrier logs the user could not obtain without a police case number.
FSS officials met mobile network operators Friday to map a single escalation ladder: verified reported phishing cases would jump from retail shops to a carrier security cell within two hours, with standardized JSON logs banks can ingest. The model mirrors how card networks share authorization traces, but for SIM events.
What changes for users
Draft rules would require carriers to freeze outbound international SMS for 24 hours after an in-store SIM replacement unless the customer confirms via the existing pass app. Banks must honor a shared “SIM swap in progress” flag when risk engines see mismatched device fingerprints.
Limits
Consumer advocates said the fix helps only if police cyber units publish weekly IOC lists small issuers can afford to load. Without that, escalation rails become another PDF for compliance officers. Still, after a volatile market week that pushed stressed investors online, regulators would rather patch OTP plumbing now than explain another nine-figure loss later.
Implementation timeline
Banks hope to pilot the shared log format with one carrier in December before expanding nationwide in the first quarter. Consumer groups asked for a single hotline number that routes to whichever network last issued a SIM, rather than forcing victims to guess which shop file to open.
Police cyber bureaus said they will align case-number issuance with the new ladder so callers are not bounced between three IVR trees on a Friday night. For regulators, the week’s losses are modest compared with card fraud peaks, but the attack pattern shows how quickly Seoul’s scam economy adapts when one door closes.