[비즈한국] With non-face-to-face transactions becoming the norm in the financial sector, cases of financial loss due to identity theft using copies of ID cards rather than originals are on the rise. Victims of identity theft have demanded compensation and countermeasures from financial companies that permit the use of ID copies during non-face-to-face identity verification processes, as well as from financial authorities for failing to regulate the practice. However, a recent Supreme Court ruling in a case where a fraudster took out a 90-million-won loan using the victim's ID copy has sparked controversy, as the court sided with the bank. Victims of identity theft are protesting, calling the decision "a ruling that ignores reality."
On August 14, the Second Division of the Supreme Court dismissed an appeal in a lawsuit filed by a voice phishing victim against Pepper Savings Bank to confirm the non-existence of debt and cancel a loan agreement. The lawsuit concerned an incident in which a victim, deceived by a voice phishing fraudster impersonating her daughter in July 2022, provided photos of her driver's license and account information. The perpetrator used a 'photo' of the victim's license to verify her identity, opened an account at Pepper Savings Bank, and took out a 90-million-won loan.
The victim, who found herself saddled with a massive debt without her knowledge, filed a lawsuit against Pepper Savings Bank, claiming that the non-face-to-face loan agreement was void. While the court of first instance ruled in favor of the victim, the decision was overturned in the second trial, and the Supreme Court's dismissal of the appeal finalized the second-instance ruling in favor of Pepper Savings Bank.
Civic groups and victims of non-face-to-face financial fraud have reacted fiercely to the Supreme Court's ruling. Concerns have been raised that the judgment is disconnected from reality and will negatively impact other victims currently engaged in litigation with financial institutions. A victims' group held an emergency seminar on August 29 to bring the issue to public attention.
Park Jung-kyung, representative of the joint committee for victims of identity theft via ID copies, emphasized, "Since we began speaking out about the ID copy issue in 2021, financial companies have significantly improved their identity verification systems. There have even been cases where victims won their lawsuits against financial firms." She added, "The situation was moving toward a resolution, with legal judgments emphasizing the importance of original ID cards. But suddenly, the Supreme Court issued this absurd ruling."
There are three main points of contention in this Supreme Court ruling. First, the court effectively stated that there is no difference between an ID copy and an original in the identity verification process. In the lawsuit, the victim of the fraudulent loan at Pepper Savings Bank argued, "Verifying identity with a previously taken photo rather than the original driver's license during a loan application cannot be considered a proper identity verification procedure."
However, the Supreme Court ruled, "Given the nature of non-face-to-face verification procedures, there is no significant difference between a bank receiving a file containing a photo taken of the original identity document at the time of the transaction versus receiving a file that was taken in advance." In effect, it determined that authentication via a copy is not problematic.
This contradicts the purpose of identity authentication. Jung Ho-chul, a deputy team leader of economic policy at the Citizens' Coalition for Economic Justice (CCEJ), pointed out, "The core of photographing an ID is confirming the identity of the person involved. The fraudster never photographed the original. The Supreme Court only discussed whether or not an original was photographed and the timing, overlooking who performed the photography." He added, "Even if an ID copy is submitted, it should in principle be submitted by the owner of the identity; this ruling ignores that. It has essentially allowed anyone to verify authenticity."
The court's view that the bank had fulfilled its duty because it used multiple authentication methods was also highlighted as a problem. The court ruled that Pepper Savings Bank had fulfilled its efforts to verify the user's identity because it went through multiple authentication steps, including △existing account verification △mobile phone authentication △joint certificate (Gongdong-injeungseo) authentication, and △credit information inquiry.
The problem is that even multiple authentication methods can be breached using an ID card. "If a fraudster succeeded in identity theft with a fake ID, the subsequent authentication methods should have blocked it. Isn't that the purpose of dual authentication?" asked Jung Ho-chul. "However, account verification and mobile phone authentication can be bypassed using an ID card. There is no independence among the authentication methods. Fingerprints, facial recognition, and physical OTPs are considered independent. The court overlooked this reality."
Victims who have been in legal battles with financial companies for years are anxious following this ruling. Representative Park Jung-kyung expressed concern, saying, "It already seems to be affecting lower-court rulings between financial firms and identity theft victims. The outcomes of four second-instance lawsuits between victims of identity theft and financial firms have become uncertain, with banks requesting postponements of sentencing just one day before the scheduled dates."
Kim Jong-ik, who suffered a 90-million-won loss after a photo of his spouse's ID was leaked through voice phishing, said, "The second-instance ruling for my lawsuit against the financial firm was scheduled for August 19 but was suddenly pushed back to September 23. Because the lawsuit result isn't finalized, my spouse still cannot engage in normal financial transactions because the account is flagged as a fraudulent one." He added, "Beyond the financial damage, the process of responding to recover from the harm is mentally agonizing," while emphasizing the need for swift relief from financial and judicial authorities.
Jo Yong-soo, who won a judgment declaring a 200-million-won fraudulent loan void after his identity was stolen at K-Bank using an ID copy, noted, "During the trial, I had to prove in detail the mobile upload procedure for ID photos. Although I won, I felt that the court did not technically understand the authentication process." He added, "As cases occur all over the country, the judiciary needs to become well-versed in identity authentication procedures."
Victims are hoping for a different outcome in remaining Supreme Court cases to gain an opportunity for a retrial. Jung Ho-chul of the CCEJ emphasized, "It is not technically difficult to verify an original ID. It is a matter of methodology," adding, "I hope the government will actively intervene to protect financial consumers and assist victims."