Received a Financial Data Breach Text? Start With These Checks

News of a data breach at a financial company naturally makes people think about their own accounts. A text message arriving a few days later and telling you to check whether you were affected can make the concern worse. But rushing to tap the address in that message may hand information to a criminal who has nothing to do with the original incident. The safer response is to change the contact route before trying to verify anything.

On October 6, Korea's Financial Services Commission and Financial Supervisory Service issued a caution-level consumer alert about voice phishing and smishing following recent personal-data leaks in parts of the financial sector. News outlets also reported a month-long special response by financial authorities. At the time of the announcement, authorities said they had found no cases of customer funds being withdrawn in connection with the incident. A breach report alone does not mean money has already left your account, but it does call for caution against impersonation attempts that use leaked information.

Verify a breach through an official channel, not the message you received

Financial authorities advise consumers not to check their status through an address in a text message. Instead, use the financial company's official website or app, or call the main customer-service number. Open the app you normally use or find the number on the official website rather than tapping a search advertisement or calling a number provided in the message. This alert was issued as a general warning to financial consumers. Seeing the alert does not by itself confirm that your information was exposed.

Knowing your name or loan details does not prove that the caller represents a real financial company. Impersonation tactics identified by the authorities include texts advertising a 'special loan for customers affected by the leak,' instructions to repay an existing loan before refinancing, demands for an upfront guarantee fee, and requests to install a security-check app. Financial authorities and legitimate financial companies do not ask for passwords or authentication codes by phone or text, and they do not tell customers to move money to another account to protect it.

Korea's three transaction-blocking services stop different activities

If identity theft is a concern, Korea's Financial Transaction Safety Block services are worth reviewing. Their names are similar, but each one blocks a different type of transaction.

Authorities say these blocks can be requested at a financial-company branch, through the Account Info service at payinfo.or.kr, or in participating bank apps. If the blocked transaction is needed later, the customer must visit a financial-company branch to remove the restriction. Anyone planning to apply for a loan or open an account soon should therefore check what the selected service will block before enrolling. A block also does not eliminate every type of fraud. You still need to refuse a transfer demanded by an impersonating caller.

Another option is to register with the Personal Information Exposure Incident Prevention System on the Financial Supervisory Service's FINE consumer portal at fine.fss.or.kr. The registration is shared with financial companies and restricts activities such as opening a new account or issuing a credit card in your name. Because it can also affect legitimate transactions you need, review the scope of the restrictions before registering.

If money has already been sent, request a payment freeze before seeking general advice

If you received a suspicious call but did not send money, you can seek advice from the Korean National Police Agency's Integrated Response Unit for Telecommunications Financial Fraud at 1394. If you were deceived and made a transfer, immediately call police at 112 or the relevant financial company's call center and request that payment be stopped. In that situation, do not lose time checking whether you enrolled in a preventive transaction block.

The response to a financial-company data leak is more straightforward than it may first seem. Start by checking whether and how your information was exposed through the company's official channel. Then consider any plans for new loans, accounts or open-banking use and choose only the transaction blocks you need. The more urgently a text or caller pushes you to act, the more important it is to find the verification route yourself.