South Korea's Financial Supervisory Service plans to strengthen card issuers' shared fraud-detection rules to cover customers deceived into making payments themselves, including purchases of gift certificates that can be converted into cash. The plan was distributed on September 15 in a regulatory release scheduled for September 16 morning reporting. [S01] [S02]
The proposed change addresses a gap between verifying who is making a payment and understanding why they are making it. A legitimate cardholder can authorize a transaction while acting on a fraudster's instructions.
Detection would extend beyond unauthorized card use
The FSS says the shared detection rules established in November 2024 have focused on transactions by third-party criminals, such as payments associated with hacking. It intends to reinforce those rules for fraud-induced payments made by customers, drawing on effective approaches already used by individual issuers. [S02]
Gift certificates matter in this setting because the purchased value can be transferred or converted after the card payment. In one example disclosed in the release, a man sent certificate PINs to a buyer and then transferred the sale proceeds onward under a romance-fraud pretext. The regulator reported KRW4.5 million in losses in that example, without dating the underlying case or naming an issuer.
The release describes difficulties obtaining compensation where customers themselves completed payments. Its planned response therefore includes intervention before approval, rather than relying only on a later dispute.
The same release gives a second gift-certificate example: a woman made a KRW800,000 card payment after being told to buy and cash out certificates as a fee for a low-interest loan. The romance-fraud example reports KRW4.5 million in losses. These are two anonymous cases selected by the regulator, with no incident dates or sampling basis; they do not show a typical loss or the prevalence of either method.
Two gift-certificate cases described by the FSS
The regulator’s disclosed amounts in two examples of customers induced to make their own card payments.
KRW
Tap or hover for details. All values are also available in the data table.
Source
Different case measures are labelled explicitly: the loan example states a payment, the romance example a loss. Case dates, total populations and recoveries are not supplied. These examples are not a statistical sample, typical loss or aggregate fraud total.
Show data tableHide data table
| Category | Amount stated in the case account |
|---|---|
| Supposed loan fee: card payment | 800,000 KRW |
| Romance case: reported loss | 4,500,000 KRW |
Additional scrutiny for flagged older buyers
For customers aged 70 or above, the FSS proposes deeper counselling when purchases of highly convertible products, including gift certificates, trigger an issuer's unusual-transaction rules. The aim is to establish the customer's genuine intention and provide an opportunity to reconsider before approval. [S02]
This is a plan for flagged transactions. It does not announce a blanket block on seniors buying gift certificates or require the same intervention for every purchase. The regulator says it may broaden the age groups and product scope after assessing the approach's effectiveness.
The FSS also plans closer examination of complaints involving suspected illegal merchants, including whether goods were delivered and how financial companies processed payments. It wants stronger controls during merchant registration and dispute handling. [S02]
Pepper Savings Bank reproduced the three planned measures in a September 17 notice attributing them to the FSS announcement. Neither that notice nor the reviewed release gives a firm implementation date or promises automatic reimbursement. [S03]
For gift-certificate sellers and card issuers, the announced direction is more scrutiny of the transaction's circumstances alongside authentication. The release establishes that supervisory intention; it does not yet demonstrate how much fraud the measures will prevent.
The regulator’s reason for focusing on older buyers includes a broader policing trend. The National Police Agency’s annual age table records 777 voice-phishing victim cases among people aged 70 or above in 2023, 1,047 in 2024 and 1,493 in 2025. The FSS quotes the same series. It covers voice phishing generally, not gift-certificate purchases alone, and cannot measure how much the proposed card controls will prevent. [S04]
The wider fraud trend behind the age-70 safeguard
National Police Agency reported voice-phishing victim cases involving people aged 70 or above; the FSS cites this series when explaining its planned intervention.
reported cases
Tap or hover for details. All values are also available in the data table.
Sources
All recorded voice-phishing victim cases in this age category, not a gift-card-only series or unique-victim estimate. Administrative counts do not measure population incidence or the effectiveness of the newly proposed controls; no 2026 total is inferred.
Show data tableHide data table
| Category | Reported cases, age70and above |
|---|---|
| 2023 | 777 reported cases |
| 2024 | 1,047 reported cases |
| 2025 | 1,493 reported cases |
In this article
Daniel Brooks
Daniel Brooks covers payment networks, financial technology, payment security, gift card fraud and PCI DSS for Gift Card News.