Beating Voice Phishing With Verification Beyond the Screen

In April, the South Chungcheong Provincial Police Agency arrested 59 members of a voice phishing ring based in Cambodia and referred 57 of them to prosecutors in custody. Among them, a group posing as government agencies is accused of impersonating prosecutors and Financial Supervisory Service officials from Phnom Penh, Thailand and Malaysia between February last year and January this year, defrauding 368 victims of more than 51.6 billion won ($37 million). It was an organized crime in which members split roles as prosecutors and FSS staff.

More striking is how they neutralized the victims' own attempts to check. Calls that reached victims displayed the real phone numbers of the agencies, and the ring members acted like prosecutors. Even when a victim hung up saying, "I will confirm whether this is really the prosecutors," and called the agency back, it did no good. A malicious app already installed on the phone had rerouted the call to another member of the ring. Even the victim's process of doubting and verifying had been built into the scam's script.

Voice phishing is no longer a crime that relies on clumsy speech and flimsy scripts. Between January and August 2025, losses from agency-impersonation voice phishing reached 675.3 billion won, accounting for 76.2% of the total 885.6 billion won in losses. The loss per case was 74.38 million won, up 76.3% from the 2024 average of 42.18 million won. Criminal rings even resort to a so-called "self-confinement" tactic, forcing victims to use secure messengers and cutting them off from outside .

Sorting victims by age has also reached its limits. Voice phishing was once seen as a problem for older adults unfamiliar with digital devices. But looking only at agency-impersonation crimes, 52% of victims between January and August 2025 were in their 20s and 30s. Older adults are exposed to schemes impersonating family and acquaintances, while young adults face schemes impersonating investigative and financial agencies. Because criminal rings tailor their scripts to a target's age and financial situation, no one can be said to be in a safe zone.

The methods and targets differ, but the cause that magnifies the damage is the same: victims have no independent means to check whether the person they are speaking to and the information before their eyes are genuine.

Today, most verification takes place inside the smartphone. Text messages, app push notifications and the caller ID shown on the screen are typical examples. The problem is that voice phishing has recently evolved to seize control of the smartphone by installing malicious apps. The malicious-app control panel identified in the police investigation displayed the victim's name and phone number, the phone model and carrier, and even call recordings, remote control and real-time location.

The moment a smartphone is taken over, the warnings passing through it are neutralized as well. A scammer can read and delete a bank's alert a suspicious transaction before the victim sees it, and a verification call can be rerouted to the wrong place through an interception app. Warning and threat end up using the same channel. A warning sent through a channel controlled by the attacker is no longer a genuine warning.

The response to voice phishing must now move to the stage. Verification must be separated from the apps and screens the scammers have seized, and transactions must not slip through quietly when verification fails. For a crime in which money, once transferred, is hard to recover, the few seconds just before the transfer are effectively the last line of defense.

One alternative is two-channel authentication using an ARS (automated response system) phone call. It reverifies a transaction carried out over the internet or in an app through the voice network. The user answers an incoming call and confirms their identity and the transaction details. The authentication record stays on the server of the financial firm, not on the user's phone. It adds one more layer of verification on a level separate from text messages or app notifications.

Domestic financial firms have used ARS authentication for procedures such as transfers and identity checks. When a suspicious transaction is detected, the system can be designed to warn the user by voice and to hold the transaction if there is no response or identity verification fails. The idea is not to replace text alerts or app authentication entirely. It is to add a last safeguard that accounts for the possibility that existing means are seized by criminal rings.

Of course, ARS is not a cure-all either. If a device is completely taken over, the possibility that even a phone response is interfered with cannot be ruled out. A victim instructed in advance by scammers could complete the authentication themselves. No method can fully overcome a situation in which both the user's phone and their judgment are controlled.

Even so, the ARS approach has an important difference. Even when text messages or app notifications are seized by a criminal ring, they can be processed as if delivered normally. The user may never see the warning, yet the financial firm's records may show "delivery complete." By contrast, ARS, when combined with network-level measures such as blocking call forwarding, can prevent a verification call from flowing through an abnormal path. The very fact that a call fails to connect or that authentication fails becomes an abnormal signal.

This difference is not small. If a verification failure is treated as a clear signal, financial firms gain grounds to hold a transaction and begin further checks. It is the difference between a door that swings open when attacked and one that closes automatically. The value of ARS lies not only in delivering a warning. It lies in letting the system recognize that a warning was not properly delivered.

The approach of simply stopping a suspicious transaction is also used abroad. Britain's "Banking Protocol" is a public-private framework in which bank staff who spot a suspected fraudulent transaction notify police and delay the transaction. If this principle of holding a transaction through human judgment is combined with automated authentication procedures, a defense system operating around the clock can be built.

Domestic policy is also shifting from a focus on individual caution toward an approach in which the communications network and financial system take responsibility. The government drew up a "Comprehensive Plan to Eradicate Voice Phishing" in August 2025, and police launched a special crackdown from that September. As a result, both the number of voice phishing cases and the losses fell 35.3% between October 2025 and April 2026 from the same period a year earlier. Measures to restrict the distribution of caller-ID-spoofing equipment and to quickly block suspicious phone numbers are part of the same trend. The aim is to cut off, at the system level, the paths the crime passes through.

A bill to amend the Special Act on the Prevention of Telecommunications-Based Financial Fraud and the Refund of Losses, which would provide ARS voice warnings for suspicious calls and transactions, has also been introduced in the National Assembly. Rather than a proposal to test new technology from scratch, it aims to extend a verification method already used in the financial sector into the areas where it is needed. In institutionalizing it, the scope of application, transaction amounts, the criteria for holding a transaction when authentication fails, personal data protection and the extent of financial firms' liability must be designed in detail.

To make ARS more effective, the guidance wording itself must change. To keep users from simply following a scammer's instruction to "press 1 when the call comes," the transfer amount and recipient should be reconfirmed by voice. It must also be made clear that government agencies and financial firms do not request money transfers for the sake of a criminal investigation. If a transfer is being made on someone's instruction, it should immediately connect to counseling or a report, and high-value transactions should be given time to consider. Adding an authentication step alone is not enough. Victims must also be given the questions and the time to break out of the scam's script.

Scams that begin on social media and messengers, such as investment-tip chat rooms and romance scams, call for a different remedy. But many voice phishing losses still begin with a phone call and are completed in front of the final transfer button. If the crime's golden time has narrowed to a matter of seconds, the defense system must operate within those few seconds as well.

Of the 368 people who sent money to the Cambodian ring, a good many probably harbored a doubt at least once at the last moment. Had a verification call come through a procedure the criminal ring had not seized, or had a financial firm halted the transfer because verification failed, the outcome might have been different.

The standard for voice phishing prevention measures can no longer stop at "was a warning sent." We must ask whether the user actually received the warning and understood the transaction, and whether the system halted the transaction when verification did not take place. Building one more channel that does not let transactions pass through quietly when attacked is something financial firms can choose.

Original reporting by Seogyeong IN (Commentary) for Seoul Economic Daily.

AI-translated from Korean. Quotes from foreign sources are based on Korean-language reports and may not reflect exact original wording.

Watch · Seoul Economic Daily