Collaboration on prevention, but why only financial institutions bear compensation?... Controversy over the "no-fault liability system" for voice phishing

Collaboration among the financial sector, telecommunications companies, and the government is key to preventing voice phishing. This is because voice phishing is a crime that spans from deception through communication networks to the misappropriation of account funds and tracking of criminals. Therefore, the government established an information-sharing platform among the financial sector, telecommunications companies, and law enforcement authorities last year. However, if damage occurs, only financial institutions bear the liability for compensation. This is the situation that would arise if the no-fault liability system for voice phishing, currently being promoted by the government, is implemented.

According to the financial sector on the 15th, financial authorities are pushing for the National Assembly to pass a revision of the Telecommunications Fraud Victim Compensation Act, which stipulates the no-fault compensation liability of financial institutions for voice phishing damages. The revision includes provisions that financial institutions must compensate up to 50 million won for voice phishing damages even without fault. The Political Affairs Committee is expected to begin discussions on the bill after the national audit.

The no-fault compensation liability system is controversial because it concentrates responsibility solely on financial institutions, differing from the government's previous policy direction aimed at eradicating voice phishing. The government has consistently emphasized joint responses among the financial sector, telecommunications companies, and law enforcement authorities. This judgment was made because crimes begin through communication networks, cause damage in financial accounts, and lead to money laundering and flight, making them difficult to stop by the power of a single institutional investor alone.

The AI platform 'ASAP' for sharing and analyzing voice phishing information, established by the Financial Services Commission (FSC) last October, is a prime example. ASAP is a platform where financial institutions, telecommunications companies, and law enforcement authorities share voice phishing information they have each secured and use AI to prevent crimes. Financial institutions, telecommunications companies, and law enforcement authorities receive information provided by other institutional investors and analysis data from ASAP, which they then utilize for account payment suspensions, phone number blocking, investigations, and other measures.

Since its launch, ASAP has shared 463,000 suspicious reports through the end of July last year, achieving results in preemptively blocking voice phishing totaling 66.36 billion won. In addition, the FSC revised the Telecommunications Fraud Victim Compensation Act starting in August to more actively share suspicious voice phishing information through ASAP, emphasizing collaboration among the financial sector, telecommunications companies, and law enforcement authorities.

Unlike the government's emphasis on voice phishing collaboration, there are concerns that introducing a no-fault compensation system where only financial institutions bear the burden could foster moral hazard among telecommunications companies and law enforcement authorities. Financial institutions have already been operating a voluntary compensation system for voice phishing since 2024, taking compensation measures when prevention efforts were insufficient; however, telecommunications companies have never compensated victims in connection with voice phishing.

Although the current Telecommunications Business Act does not stipulate liability for damages, it does prescribe various obligations for telecommunications companies to block voice phishing. Article 32-4 of the Act requires telecommunications companies to verify the identity of subscribers using systems such as the fraudulent registration prevention system to prevent the use of "dapo phones" (phones registered under false identities). Additionally, Article 84-2 of the same Act stipulates that telecommunications companies must block or correct calls from phone numbers displayed falsely and suspend communication services.

Nevertheless, according to the National Police Agency, the number of dapo phones detected in 2024 reached 97,399, more than ten times the 8,923 detected in 2020. This highlights the need for expanded regulations on telecommunications, a primary tool used in voice phishing crimes.

The roles of the government and law enforcement authorities are also defined by law. Article 2-2 of the Telecommunications Fraud Victim Compensation Act stipulates that the Financial Services Commission (FSC) must take response measures to prevent and minimize damage, such as collecting and disseminating information related to voice phishing and issuing forecasts and alerts. The Integrated Reporting and Response Center for Telecommunications and Financial Fraud, established under the National Police Agency, is responsible not only for receiving reports and tips but also for requesting payment suspensions on fraud-utilized accounts, requesting suspension of communication services for phone numbers used in crimes, and analyzing and disseminating related information, pursuant to Article 2-7 of the same Act.

A financial sector official stated, "Responsibilities and roles have been divided through ASAP, but under the no-fault compensation liability system, only financial institutions bear the burden." The official added, "Instead of patching up the Telecommunications Fraud Victim Compensation Act, which falls under the FSC's jurisdiction, we need to present fundamental measures that include telecommunications companies and the government through a special law."

As the introduction of a "no-fault liability system" that requires financial institutions (banks) to compensate customers even if they have committed no fault is being pushed, legal controversies are intensifying. This is because it creates an exception to the Civil Code principle that damages should be borne by those who acted with intent or negligence, and because the structure effectively requires financial institutions to prove whether the victim acted with intent or gross negligence—a matter difficult for them to access.

According to reports from the financial sector and political circles on the 15th, a revision of the "Special Act on Prevention of Telecommunications and Financial Fraud Damage and Refund of Damages" (Telecommunications Fraud Victim Compensation Act), introduced by Representatives Kang Jun-hyun and Cho In-cheol of the Democratic Party of Korea as lead sponsors in the National Assembly Political Affairs Committee, is pending. While the two bills differ in compensation limits and methods, their core provision is that financial institutions must compensate all or part of voice phishing damages if certain conditions are met, even without intent or negligence on their part. Financial authorities are also promoting the introduction of a no-fault liability system as a key task for countering voice phishing.

This violates the current Civil Code principle of damage compensation. Article 750 of the Civil Code imposes liability for damages on "those who cause harm to others through unlawful acts committed with intent or negligence." In other words, the basic principle is "fault-based liability," where one is responsible for damages caused by their own fault, and this applies in principle to the relationship between financial institutions and financial consumers as well.

The domestic legal system does not entirely lack no-fault liability. Representative examples include the Product Liability Act, the Act on Compensation for Environmental Pollution Damage and Relief, the Nuclear Damage Compensation Act, and the Motor Vehicle Liability Insurance Act. However, these systems are strongly characterized as "risk liability," where the party controlling or managing a risk source bears responsibility when that risk materializes. A review report by the chief expert of the National Assembly Political Affairs Committee explained that these laws represent a modification of the fault-based principle to make those who control risk sources bear damages as risks such as industrial accidents and environmental pollution increase.

Taking the Product Liability Act as an example, manufacturers bear responsibility not because they were at fault, but because damage occurred to a consumer's life, body, or property due to a "defect" in the product they manufactured. This means there is a direct control and management relationship between the risk source (the product) and the manufacturer.

In contrast, the structure of voice phishing is different. Particularly in cases of fraud where victims are deceived by criminals into making direct transfers with their own consent (APP: Authorized Push Payment), financial institutions simply receive and execute legitimate transaction instructions from customers. In non-face-to-face transactions, it is difficult for financial institutions to determine what conversations customers had or why they decided to make a transfer, and proactively suspecting their true intent is also limited.

Particularly controversial is the burden of proof. The revision bill sets as exemptions situations where the user acted with intent or gross negligence, or when the financial institution made sufficient efforts to prevent voice phishing, and requires the financial institution to prove that such exemption conditions are met. Ultimately, victims do not need to prove the financial institution's fault, while financial institutions seeking to avoid compensation liability must prove exemptions such as the victim's intent or gross negligence.

The financial sector points out that this structure amounts to a "double shift of responsibility." First, it imposes compensation liability even when the financial institution is not at fault; second, to be exempt from liability, the financial institution must prove the consumer's culpable factors as well.

The problem is that it is not easy for financial institutions to access key information needed to judge whether a victim acted with intent or gross negligence. Details such as what conversations the victim had with the fraudster, how the fraudster obtained personal information, and to what extent the victim suspected the criminal's words are difficult to verify solely through financial transaction records. Information necessary for judging intent or gross negligence—such as the content of conversations between the criminal and the victim, the circumstances under which the criminal obtained the victim's personal information, the victim's level of financial knowledge and background for misunderstanding facts, and the degree to which the victim suspected the criminal's statements—is difficult for financial institutions to ascertain independently or verify objectively.

For this reason, the revision bill itself includes separate provisions allowing financial institutions to request investigation information on victims and investigative information on suspects from law enforcement authorities and the Financial Supervisory Service (FSS) when determining whether to provide compensation and the amount thereof. This reflects consideration during the legislative process that relying solely on a financial institution's own information has limitations in deciding on compensation.

A proposal to broadly shift the burden of proof regarding the sales process of financial products to financial institutions was also not adopted after controversy during the enactment of the Financial Consumer Protection Act. At that time, a plan to place the burden of proof for damage compensation liability on financial institutions regarding financial product sellers was reviewed, but concerns were raised that it should be recognized only as extremely limitedly, similar to the civil litigation system where the person claiming rights must prove them; thus, it was not reflected in the final legislation.

Cautious opinions are also emerging in the National Assembly. In a review report, the chief expert of the Political Affairs Committee positively evaluated the purpose of victim relief through the introduction of no-fault liability but pointed out concerns that imposing damage-sharing responsibility on financial institutions even when they are not at fault may violate the principle of self-responsibility under the Civil Code. The official also stated that it is necessary to consider the possibility of reduced vigilance among users of financial services, false damage reports, and decreased transaction convenience due to strengthened financial security.

There are also indications that imposing no-fault liability solely on financial institutions could infringe upon property rights and the right to equality under the Constitution. Since various operators beyond financial institutions, such as telecommunications equipment and platforms, are involved in voice phishing, it must be examined whether there is a reasonable basis for designating only financial institutions as targets of no-fault liability.