Korea: Unauthorised Toss Payments Prompt Wider Review of Fintechs

Source: Regulation Asia Editors, Regulation Asia 2020-06-12

The FSS is considering conducting reviews of some 40 fintech companies after eight unauthorised transactions were detected on Viva Republica’s payments platform Toss.

South Korean unicorn Viva Republica this week reported unauthorised payments on its popular money transfer platform known as Toss.

A total of eight unathorised purchases worth KRW 9.4 million (USD 7,800) were found to have been made on 3 June from three online websites – including the website of US gaming company Blizzard.

Stolen personal data, rather than hacking, appeared to have been the cause of the unathorised payments, as they occurred through the Toss website. Unlike the Toss mobile app, which requires input of a SMS verification code to login, the website only requires input of a user’s personal data – name, birthday, and a five-digit Toss password.

Toss’s own systems are unlikely to have been the source of the data leak, as it does not store user passwords. Still, Viva Republica has compensated the eight customers and has vowed to further strengthen security.

The incident has resulted in wider scrutiny of the fintech sector. The FSS (Financial Supervisory Service) is reportedly considering plans to conduct reviews of some 40 fintech companies and their systems.

Viva Republica said it is cooperating with police and related agencies to identify the source of the unauthorised payments.

The company, valued at an estimated USD 2.2 billion, received a preliminary licence in December to operate Korea’s third online-only bank, which it plans to launch this or next year.

Viva Republica also plans to launch a brokerage service this year, and to potentially file for an IPO within the next three years.

Korea: Unauthorised Toss Payments Prompt Wider Review of Fintechs

Subscribe to Our Newsletter!

Subscribe to Our Newsletter!