If a financial institution notifies you that your personal information has been exposed, do not click links in text messages. Instead, use the institution's official app or customer service center to check which information was exposed and what protective measures are available. Financial authorities have extended the special response period for preventing secondary damage from personal information breaches through the end of December 2026. The Financial Transaction Security Blocking Service and the Personal Information Exposure Accident Prevention System can help prevent unauthorized financial transactions carried out in your name.
Pay particular attention to calls impersonating lenders offering low-interest loans, invitations to refinance existing loans, and text messages claiming that you are entitled to compensation for a data breach. Just because someone knows your name or exact loan limit does not prove that they are an employee of a financial institution.
Why Has the Financial Sector's Personal Information Breach Response Period Been Extended Through December?
On November 6, 2026, the Financial Services Commission announced that the special response period for preventing secondary damage resulting from personal information breaches in the financial sector would be extended through the end of December.
The original special response period was scheduled to run from October 6 through November 5. However, as additional personal information breach incidents were identified in the financial sector, authorities decided to maintain preventive measures.
The main circumstances announced by financial authorities at the time were as follows:
Special response period for preventing secondary damage: Extended through the end of December 2026
Consumer alert: Existing caution-level warning maintained
Secondary damage situation: As of November 6, no cases of customer funds being stolen through related voice phishing or smishing attacks had been reported
Financial institution measures: Dedicated consultation channels for affected customers and enhanced suspicious-transaction detection systems were being operated
One important point is that the absence of reported damage does not mean the risk of financial fraud has disappeared.
Financial authorities instructed individual financial institutions to continue preventive measures based on the types and scope of information exposed in each incident.
What Should You Do First After Receiving a Personal Information Breach Notice?
The first priority is to confirm the breach and determine its scope. Review the personal information listed in the notification, the circumstances of the incident, and the protective measures recommended by the financial institution.
Follow these steps:
1. Do not click links included in text messages or emails.
2. Open the financial institution's official website or an app you have already installed.
3. Contact the institution using its official customer service number to verify that the breach notification is genuine.
4. Check which information was actually exposed, such as your name, contact details, address, or account information.
5. Ask the financial institution whether you need to change your passwords or take additional protective measures.
6. Check whether you have enrolled in the Financial Transaction Security Blocking Service.
Be especially careful of fraudulent messages disguised as personal information breach notifications.
Scammers may contact people affected by data breaches, claiming that they will receive compensation or that an unauthorized account has been opened in their name. They may then attempt to direct victims to fake websites or persuade them to install malicious apps.
Financial authorities and financial institutions do not ask customers to disclose account passwords or authentication codes by phone or text message. They also do not instruct customers to transfer money to a particular account in the name of protecting their assets. Loan procedures should not involve demands for advance payments or the installation of apps through suspicious links.
What Does the Financial Transaction Security Blocking Service Prevent?
The Financial Transaction Security Blocking Service allows individuals to proactively block certain financial transactions from being carried out without authorization in their name.
The three blocking functions currently promoted by financial authorities are:
| Service | Transactions blocked |
|---|---|
| Credit Transaction Security Blocking | Credit loans, card loans, credit card issuance, installment financing, and other credit transactions |
| Non-Face-to-Face Account Opening Security Blocking | Opening new deposit accounts through non-face-to-face channels |
| Open Banking Security Blocking | Account information inquiries and transactions through open banking |
These three services cover different types of financial transactions, so you should identify which protections you need.
For example, if you are concerned that someone might take out a loan in your name without your knowledge, check the Credit Transaction Security Blocking service. If you are worried that someone could open an account in your name through online or mobile channels, consider enabling Non-Face-to-Face Account Opening Security Blocking as well.
If you are concerned about unauthorized account inquiries or transfers through open banking, you can also consider the third function.
How to Apply
The application channels announced by the Financial Services Commission include:
Visiting a branch of a financial institution where you hold an account or conduct transactions
Using a bank's mobile banking app
Using the Account Information Integrated Management Service's My Accounts at a Glance service (payinfo.or.kr)
If you need to conduct a financial transaction after enrolling in a blocking service, you can visit a financial institution's branch to解除 the restriction. Once the restriction is lifted, you can use the relevant financial service again, and you may enroll in the blocking service again afterward.
How Is the Personal Information Exposure Accident Prevention System Different from the Blocking Service?
Although the two systems may appear similar, they protect consumers in different ways.
The Financial Transaction Security Blocking Service directly prevents specific financial transactions. By contrast, the Personal Information Exposure Accident Prevention System informs financial institutions that an individual's personal information has been exposed, allowing them to apply additional identity checks and restrictions when new financial transactions are requested in that person's name.
The Financial Supervisory Service's Personal Information Exposure Accident Prevention System is available through Fine, its financial consumer information portal.
How to Register as a Person Whose Personal Information Has Been Exposed
1. Access the Financial Supervisory Service's Fine portal: Visit the financial consumer information portal and find the Personal Information Exposure Accident Prevention section.
2. Verify your identity and register: Complete identity verification and register the fact that your personal information has been exposed.
3. Information sharing with financial institutions: Your registration information is shared with financial institutions.
4. Additional verification during new transactions: Certain financial transactions, including opening new accounts and issuing credit cards, may be restricted.
Official system: Financial Supervisory Service Personal Information Exposure Accident Prevention System.
Registering as a person whose personal information has been exposed does not replace the Financial Transaction Security Blocking Service. The two systems have different protective purposes and apply to different transactions, so you may consider using both.
However, registration can also restrict legitimate financial activities, including opening new accounts or obtaining credit cards. Consider whether you need to carry out these transactions before registering.
Which Phone Calls and Text Messages Should You Suspect of Being Voice Phishing?
After a personal information breach, be alert to scammers who approach you while pretending to be employees of legitimate financial institutions.
Be particularly suspicious of the following requests:
| Approach | Why you should be cautious |
|---|---|
| Text messages offering compensation for a personal information breach | They may direct you to fraudulent websites. |
| Special low-interest loan offers | The sender may be impersonating an employee of a financial institution. |
| Requests to repay an existing loan first | They may attempt to persuade you to transfer money to an account belonging to the scammer. |
| Advance payments to improve your credit score | This may be a demand for money disguised as a loan arrangement. |
| Requests to install an app for a security inspection | There is a risk of installing remote-control or malicious software. |
| Requests for authentication codes or account passwords | These may be attempts to steal your financial information. |
Be particularly careful of refinancing offers claiming that you can obtain a lower interest rate if you repay your existing loan first.
Even if the caller knows your outstanding loan balance or income information, never transfer money to an account provided over the phone.
To verify whether a contact genuinely comes from a financial institution or financial authority, call the institution directly using an official customer service number you already know. Do not rely on a phone number provided by the caller.
What Should You Do If You Have Already Clicked a Suspicious Link?
Clicking a link alone does not necessarily mean that your financial accounts have been compromised. However, if an app was installed or you entered personal or authentication information, you should take prompt action.
If you only opened the link and did not enter any information: Stop accessing the website and do not download any files.
If you entered your resident registration number, account password, authentication code, or similar information: Contact the relevant financial institution immediately.
If you installed an app or allowed remote control of your device: Use another secure device to contact your financial institution and the police for assistance.
If you discover an unfamiliar transfer from your account: Immediately report it to your financial institution's call center and the police, and request that the account be frozen against further transactions.
The appropriate steps to take after clicking a smishing link depend on whether malicious software was installed on your phone.
Which Numbers Should You Contact If You Have Already Suffered Financial Losses?
If you receive a suspicious phone call or suspect that you may be the target of financial fraud, you can seek assistance through the National Police Agency's Integrated Response Center for Telecommunications Financial Fraud at 1394.
If you have already transferred money, do not simply wait for advice. Immediately request that the transaction be suspended and the relevant account be frozen.
1394: Consultation for suspected voice phishing
112: Police emergency reporting
Financial institution call center: Request an account payment suspension and verify financial transactions
It is important to contact not only the financial institution from which you sent the money but also the financial institution holding the recipient's account as quickly as possible to inquire about payment suspension procedures.
Personal Information Breach Prevention Checklist Through the End of December
The financial sector's special response period has been extended through the end of December. While financial institutions continue their response measures, consumers should also review the financial transactions conducted in their own names.
Check the personal information breach notification through the financial institution's official app.
Identify the specific personal information that was exposed.
Check the dedicated customer consultation channel and protective measures provided by the financial institution.
Check whether you have applied for Credit Transaction Security Blocking.
Check whether you have applied for Non-Face-to-Face Account Opening Security Blocking.
Determine whether you need Open Banking Security Blocking.
Consider registering with the Personal Information Exposure Accident Prevention System.
Check whether there are any unfamiliar loans or accounts in your name.
Do not open links in messages from unknown sources or install suspicious apps.
Immediately report any suspicious activity involving your financial transactions.
Receiving a notification that your personal information has been exposed does not necessarily mean that your financial accounts have also been compromised. However, because exposed information can be exploited in financial scams, do not stop at simply deleting the notification. Check the protective measures available for financial transactions conducted in your name as well.
There is no need to wait until the special response period ends in December. Contact your financial institution as soon as you receive a breach notification and apply for the necessary blocking services without delay.
