Voice phishing cases detected by major banks double in 2025

The five major banks confirmed 8,760 voice phishing transactions as actual fraud in 2025. This figure matters because it counts cases that were not merely suspicious. Banks first flagged and temporarily suspended the transactions, then confirmed fraud through follow-up checks.

The 2025 total was more than double the 4,343 cases confirmed in 2024. The banks involved were KB Kookmin Bank, Shinhan Bank, Hana Bank, Woori Bank and NH Nonghyup Bank. Their fraud detection systems initially flagged many more transactions than they ultimately confirmed.

The increase shows that voice phishing remains a serious banking threat. It also highlights why temporary intervention matters. Monitoring systems can identify warning signs, while human or bank-level review can determine whether a transaction was genuinely fraudulent. The data does not state how much money was lost or recovered in these cases.

Voice phishing is a scam conducted through phone calls. A criminal pretends to represent a trusted institution, official or other familiar party. The caller creates urgency or fear and persuades someone to transfer money or reveal confidential information. The source article reports the fraud trend but does not describe specific caller scripts.

In a typical example, a caller might claim that an account has a problem and demand immediate action. The victim may then disclose banking details or approve a payment. The central mechanism is social engineering: the criminal manipulates trust and emotion instead of directly breaking into a bank system.

Banks’ monitoring systems can identify unusual transactions after a victim acts. The article reports 1.11 million suspected voice phishing transactions flagged in 2025. However, it does not state how many victims were deceived by particular tactics, which institutions criminals impersonated, or how much money each case involved.

A fraud detection system, or FDS, is a technical system that watches banking transactions, user activity and other data in real time. Its purpose is to identify patterns that may indicate fraud. This matters because rapid detection gives a bank an opportunity to intervene before a suspicious payment is completed or causes further harm.

For example, an FDS may flag a transaction when its activity appears unusual under the system’s monitoring rules. The article does not specify the exact rules used by the five banks. After a flag, banks can take temporary measures, such as suspending the transaction, and later determine whether it was actual fraud.

The five banks’ systems flagged 1.11 million suspected voice phishing transactions in 2025, up 39.9 percent from 796,000 in 2024. They temporarily acted against 157,000 transactions. Only 8,760 were later confirmed as fraud, showing that a flag is a warning, not proof.

An automated flag means a transaction looks suspicious, not that fraud has been proven. Monitoring systems are designed to catch possible threats broadly. They can therefore produce false positives, including legitimate payments that resemble risky activity. Confirmation requires additional review or evidence after the bank intervenes.

In 2025, the five banks’ systems flagged 1.11 million suspected voice phishing transactions. Banks took temporary measures against 157,000 of them. After those interventions and follow-up checks, 8,760 were confirmed as actual fraud. The figures describe three different stages: detection, temporary action and confirmation.

This filtering process explains the large gap. Broad monitoring helps avoid missing potential scams, while confirmation is a narrower judgment. The article does not explain the banks’ review criteria or how long investigations took. It does show that suspected activity increased substantially, while confirmed cases remained a much smaller subset.

A temporary suspension places a pause or restriction on a suspicious transaction while the bank reviews it. This matters because real-time payments can move quickly. A pause creates time to contact the customer, check the transaction and determine whether the payment reflects genuine activity or a scam.

For example, if an FDS flags a transfer, the bank may temporarily stop it and seek confirmation. If the customer identifies it as fraudulent, the payment may not proceed. If the transaction is legitimate, the bank can release it after review. The article confirms that the five banks used temporary measures before confirming fraud, but it does not specify the exact procedure.

In 2025, banks took temporary measures against 157,000 transactions and later confirmed 8,760 as fraud. Suspension cannot guarantee recovery or prevent every loss. Its value is speed: interrupting suspicious activity may reduce the chance that money leaves before the warning is investigated.

Automated monitoring is only one layer of protection. Banks can add customer call-backs, trained fraud teams, transfer limits, stronger warnings and rapid account freezes. Customers can verify callers through official contact channels, avoid sharing passwords or codes, and pause before approving unexpected payments. These measures address both technology and human decision-making.

For example, a bank could pause an unusual transfer and ask the customer to confirm the recipient independently. A customer who receives a threatening call could end it and contact the bank using its official number. Multi-factor authentication and transaction alerts can also make unauthorized access or unexpected payments easier to detect, although they cannot stop every deception.

The article specifically reports FDS flags and temporary measures, but it does not list other protections. In general, layered defenses are useful because criminals can persuade a legitimate customer to authorize a payment. Better warnings, staff review and customer awareness can complement automated systems.

Real-time digital payments are vulnerable to social engineering because speed and convenience leave little time for reflection. A criminal may persuade the legitimate account holder to act immediately. The payment can then appear technically valid, even though the decision was manipulated. The article reports rising suspected and confirmed voice phishing, but does not explain payment authorization procedures.

Authentication asks whether the person is really the account holder. It may use a password, device check, biometric or one-time code. Authorization is the separate decision to approve a particular action, such as sending money to a recipient. A user can pass authentication and still be deceived into authorizing a fraudulent transfer.

Banks use fraud monitoring to add another review layer after or during payment activity. The five banks flagged 1.11 million suspected transactions in 2025 and temporarily acted against 157,000. Strong authentication helps protect account access, while transaction warnings, limits and human review can address manipulated approvals.