As efforts intensify to introduce a "no-fault liability system" that would require banks (financial institutions) to compensate customers even if they committed no wrongdoing when victims suffer losses from voice phishing, legal controversies are growing. This is because the proposal creates an exception to the civil code’s principle that only those with intent or negligence bear compensation liability, and it effectively requires financial institutions to prove whether victims acted intentionally or with gross negligence—information difficult for them to access.
According to reports from the financial sector and political circles on the 15th, the National Assembly's Political Affairs Committee is considering two revised bills introduced respectively by Representatives Kang Jun-hyun and Cho In-cheol of the Democratic Party of Korea: the "Special Act on Prevention of Telecommunications Financial Fraud and Refund of Damages" (Telecom Fraud Damage Refund Act). While the two bills differ in compensation limits and methods, their core provision is that financial institutions must compensate all or part of voice phishing losses if certain conditions are met, regardless of whether they acted with intent or negligence. The financial authorities are also advancing the introduction of a no-fault liability system as a key measure to combat voice phishing.
This approach contradicts the current civil code's principle on damage compensation. Article 750 of the Civil Code imposes liability for damages only on those who cause harm through unlawful acts committed with intent or negligence. In other words, the fundamental principle is "fault-based liability," meaning one bears responsibility only for losses caused by their own fault—a principle that also applies in principle to relationships between financial institutions and financial consumers.
The domestic legal system does not entirely lack no-fault liability. Representative examples include the Product Liability Act, the Act on Compensation for Environmental Pollution Damage and Relief, the Nuclear Damage Compensation Act, and the Automobile Damage Compensation Guarantee Act. However, these systems are characterized as "risk liability," where entities that control or manage a risk source bear responsibility when that risk materializes. A review report by the chief expert of the National Assembly's Political Affairs Committee explained that these laws modify the fault-based principle to require those controlling risk sources to bear damages as risks such as industrial accidents and environmental pollution increase.
Taking the Product Liability Act as an example, manufacturers bear liability not because they were negligent, but because a "defect" in their manufactured product caused damage to consumers' lives, bodies, or property. This reflects a direct control and management relationship between the risk source (the product) and the manufacturer.
In contrast, voice phishing involves a different structure. Especially in cases of fraud where victims are deceived by criminals into transferring funds directly with their own consent (APP: Authorized Push Payment), financial institutions merely execute transactions based on legitimate instructions from customers. In non-face-to-face transactions, it is difficult for financial institutions to determine what conversations customers had or why they decided to transfer funds, and proactively suspecting the authenticity of such transactions is also limited.
Particularly controversial is the allocation of the burden of proof. The revised bill designates as exemptions situations where users acted with intent or gross negligence, or where financial institutions made sufficient efforts to prevent voice phishing, and requires financial institutions to prove that such exemption conditions are met. Consequently, victims need not prove the financial institution's fault, while financial institutions seeking to avoid compensation liability must demonstrate the victim's intent, gross negligence, or other exempting circumstances.
The financial sector points out that this structure effectively constitutes a "double shift of responsibility." First, it imposes compensation liability on financial institutions even without fault; second, to be exempted, financial institutions must prove consumer-side culpability such as the victim's intent or gross negligence.
The problem is that financial institutions find it difficult to access core information needed to determine whether victims acted with intent or gross negligence. Details such as what conversations victims had with scammers, how scammers obtained personal information, and the extent to which victims suspected the criminals' statements are hard to verify through financial transaction records alone. Information necessary for determining intent or gross negligence—including dialogue between criminals and victims, circumstances under which criminals acquired victims' personal data, victims' level of financial knowledge, background of misunderstandings about facts, and the degree to which victims suspected criminals' remarks—is difficult for financial institutions to ascertain independently or verify objectively.
For this reason, the revised bill itself includes separate provisions allowing financial institutions to request victim investigation information and suspect interrogation records from law enforcement authorities and the Financial Supervisory Service when determining whether compensation should be made and in what amount. This reflects legislative consideration of the limitations inherent in relying solely on a financial institution's own information to decide on compensation.
A proposal to broadly shift the burden of proof regarding the sales process of financial products to financial institutions was also debated during the enactment of the Financial Consumer Protection Act but ultimately rejected. At that time, while measures were considered to place the burden of proof for damage compensation liability on financial product providers, concerns were raised that this would conflict with the civil litigation system's principle that the party asserting a right must prove it, and such an approach should be recognized only in extremely limited cases akin to those involving foreign investors. Consequently, it was not reflected in the final legislation.
Cautious voices are also emerging within the National Assembly. In its review report, the chief expert of the Political Affairs Committee positively evaluated the victim relief purpose of introducing no-fault liability but warned that imposing damage-sharing responsibility on financial institutions even when they bear no fault may violate the civil code's principle of self-responsibility. The committee further noted that potential consequences such as reduced vigilance among financial service users, false damage reports, and decreased transaction convenience due to strengthened financial security measures must also be carefully examined.
Critics also argue that imposing no-fault liability solely on financial institutions could infringe upon constitutional rights to property and equality. Since voice phishing involves not only financial institutions but also various operators such as communication device and platform providers, there is a need to examine whether there is a reasonable basis for targeting only financial institutions with no-fault liability.
in FINANCE
