[비즈한국] It has been confirmed that K-Bank has successfully overturned a lower court ruling in an appeal case regarding a damages suit filed by a victim of cryptocurrency voice phishing. K-Bank is the bank that maintains a real-name account partnership with Upbit, South Korea's No. 1 cryptocurrency exchange (operated by Dunamu). In the first trial, K-Bank was ordered to pay partial damages due to negligence in responding to voice phishing crimes, but the situation reversed in the second trial as the court ruled that the bank had no "duty to notify" the exchange.
On November 15, the Seoul Central District Court’s Civil Division 1-2 (Presiding Judge Kim Yong-du) ruled to revoke the parts of the first-instance judgment that went against K-Bank in the damages suit filed by voice phishing victim A. The first trial of this case drew industry attention as it was the first instance where a bank providing real-name accounts to a cryptocurrency exchange was held liable for voice phishing-related damages.
The background of the case is as follows: Person A opened a K-Bank account on February 28, 2021, and began trading crypto on Upbit. A received their first voice phishing call on August 3 of that year, and from that day until August 21, 2021, transferred money from their K-Bank account to their Upbit account. The funds transferred to Upbit were converted into Bitcoin and sent to accounts under third-party names. The total amount of Bitcoin sent from A's Upbit account to the phishing group amounts to approximately 1.45 billion won when converted to Korean won.
A was not the only victim. Two additional victims transferred money to A's K-Bank account, which was being used as a crime account. One of these victims reported the fraud to the Financial Supervisory Service at 12:30 PM on August 20, 2021, and requested a freeze on A's account. K-Bank suspended the account at 3:34 PM that same day and sent a text message to A at 3:48 PM stating, "Payments have been suspended under the Special Act on Prevention of Telecommunications-based Financial Fraud."
The issue was that Upbit was only notified that A’s account was subject to fraud reports on August 23, 2021, at 8:27 PM—three days after K-Bank’s action. K-Bank and Upbit had been collaborating since June 2020 through a "joint response hotline" to prevent financial crimes like voice phishing. At 8:38 PM on the 23rd, Upbit sent a text message to A informing them that their service usage was restricted (suspended) due to the account being linked to a financial accident.
During the discrepancy in the two companies' responses, A, who was unaware they were being targeted by voice phishing, transferred an additional 515 million won worth of Bitcoin to the scammers' account on August 21, 2021, before their Upbit account was blocked. Believing that K-Bank and Dunamu were responsible for the damages incurred on August 21, A filed a damages suit claiming 50 million won out of the approximately 515 million won loss.
When the first trial result was announced on July 10, 2023, the fortunes of Dunamu and K-Bank diverged. The court found Dunamu not liable, noting there was no evidence that K-Bank had sent a notification to Dunamu. However, K-Bank could not avoid liability. The first-instance court judged that K-Bank was liable for "negligent action" for failing to notify Dunamu of the accident in a timely manner. However, it also ruled that because A had transferred funds to a third-party account despite suspicious circumstances, K-Bank was only 30% liable (approximately 154.5 million won).
Dissatisfied with the result, K-Bank appealed. They argued that they had fulfilled their duty to prevent damage by notifying A, the account holder, and that they had no legal duty to notify Dunamu. They also emphasized that there was no causal relationship, as A had already withdrawn all funds from the K-Bank account before transferring the additional 500 million won worth of Bitcoin to the scammers.
The appellate court overturned the lower court's ruling and sided with K-Bank. The deciding factor was the bank's "duty to notify." According to the "Special Act on the Prevention of Telecommunications-based Financial Fraud and Refund of Damages," financial institutions must suspend accounts used for fraud and notify the following parties: the account holder, the victim, financial institutions, the Financial Supervisory Service, and investigative agencies. The second-instance court ruled that because Dunamu, as a "virtual asset service provider," does not qualify as a financial institution under this act, K-Bank had no legal duty to notify them.
The court also rejected A's claim that there was a contractual or good-faith duty to notify because the two companies had established a joint response hotline. The court judged that the hotline was a system voluntarily set up by K-Bank and Dunamu and was not a matter of contract or legal obligation. It also noted that there were no regulations regarding K-Bank’s duty to notify in Upbit’s terms of service.
While K-Bank has breathed a sigh of relief after being absolved of liability, the final judgment rests with the Supreme Court. A, who has been denied damages, filed an appeal to the Supreme Court on December 2. A K-Bank official stated, "As the trial is ongoing, it is difficult to express a position."
Meanwhile, as voice phishing crimes involving cryptocurrency continue to rise, filling the legal vacuum has become urgent. According to the Financial Services Commission, damages from crypto-related voice phishing surged from 8.3 billion won in 2020 to 20 billion won in 2022. Consequently, on October 7, Rep. Jo Seung-rae of the Democratic Party of Korea and others proposed an amendment to include virtual asset service providers as subjects under the Telecommunications-based Financial Fraud Refund Act.