As AI makes convincing impersonation easier to produce and harder to recognize, South Korean companies may need to rethink a basic assumption behind corporate payments: that a familiar email, phone call or video meeting is enough to establish who is asking to be paid.
South Korea is investing heavily in making fraud detection faster and more intelligent. Its AI-based Anti-Phishing Sharing and Analysis Platform, or ASAP, prevented an estimated KRW 66.4 billion ($47.6 million) in financial losses between October 2025 and July 2026, according to the Financial Services Commission. During that period, 463,000 pieces of suspected voice-phishing information were shared and payments were suspended on 7,009 accounts.
The system became more powerful in August after revised rules enabled financial institutions, telecommunications companies and investigative authorities to share suspected fraud information more easily through ASAP. Yet the scale of fraud remains significant. Payment suspensions involving accounts linked to voice phishing and other telecommunications financial fraud reached 102,131 in 2025, up 42.1% from the previous year.
The numbers point to an uncomfortable reality. Better detection can stop suspicious transactions, but it cannot eliminate a more difficult category of fraud: situations in which a legitimate employee authorizes a legitimate-looking payment because someone successfully impersonated a trusted person or compromised a trusted communication channel.
AI Is Not Inventing Social Engineering. It Is Making It Cheaper
Deepfakes have become the most visible symbol of AI-enabled fraud, but they are only one part of a broader shift. Business email compromise, supplier impersonation and social engineering existed long before generative AI. Their effectiveness comes from exploiting authority, familiarity and urgency. AI can now make those attacks cheaper, more personalized and easier to scale.
The threat is becoming more sophisticated in South Korea’s broader cybersecurity environment as well. A recent report from South Korean cybersecurity company Genians found evidence that the North Korean-linked Kimsuky group had assembled AI tools that could support document analysis, phishing, malware development and attack automation. The findings have not been independently verified, but they indicate how AI capabilities are moving deeper into cyberattack workflows.
For businesses, that changes the economics of impersonation. An attacker no longer needs to create an obviously fake message. The objective can simply be to create enough credible context for an employee to stop questioning the request.
The Problem With Trusting the Communication Channel
This is where traditional payment controls face a growing weakness. For years, finance teams have used email confirmations, phone calls and personal relationships as practical mechanisms for establishing trust. A supplier sends a bank-account change by email. An employee calls a known contact to confirm it. An executive requests an urgent payment. The finance team verifies the request through a familiar channel. But those channels are increasingly vulnerable.
Speaking with KoreaTechToday, Andy Thiss, VP & GM APAC at Eftsure, said companies are discovering that sophisticated fraud does not necessarily require deepfake technology.
“South Korea’s response shows how seriously some governments are taking AI-enabled fraud, and we applaud any legal framework that makes it harder for fraudsters to leverage AI-generated material. Unfortunately, we’re living in an era where fraud tactics are cheap and establishing truth is expensive. For finance teams, this means traditional human checks are becoming less reliable in general. At Eftsure, we’ve stopped many fraud attempts that rely only on email and months of cultivated trust. Social engineering is still effective even without deepfakes or AI-generated material. Businesses need independent verification of who they’re paying, separate from the email, phone call, or video meeting that triggered the payment.”
The important point is not that employees can no longer trust email. It is that the communication channel should not itself be treated as proof of identity.
Korea Is Improving Fraud Detection. Verification Is the Next Layer
South Korea’s ASAP platform demonstrates what automated, cross-institution fraud detection can accomplish. Since its October 2025 launch, financial institutions have been able to share multiple categories of suspected phishing information in real time, including suspicious accounts, victim accounts, malicious applications and other investigation-related information.
The government has since expanded the framework beyond the financial sector. The revised rules that took effect in August allow financial companies, telecom providers and investigative authorities to exchange suspected voice-phishing information more quickly.
That represents an important shift from responding to fraud after money moves toward identifying suspicious activity earlier. But corporate payment fraud presents a different challenge. A bank may see an authorized transaction. The employee may have approved it. The recipient’s account may not immediately appear suspicious.
The fraud occurred before the payment was authorized, when the attacker manipulated the identity behind the request. This creates an important distinction between fraud detection and identity verification. Detection asks: Does this transaction look suspicious? Verification asks: Is this actually the person or business that should receive the money?
The New Payment Control Is Independent Verification
The implication for Korean businesses is not that every payment should require a lengthy manual investigation. That would create too much friction and encourage employees to bypass controls. The challenge is to make independent verification inexpensive and routine.
Instead of treating an email from a supplier as sufficient evidence that its bank details have changed, companies can verify those details through a separate trusted process. Instead of relying exclusively on a phone number contained in an email, finance teams can use independently sourced contact information. Automated systems can also flag unusual payment behavior or changes to established vendor information before funds move.
The objective is simple: Separate the communication that triggers a payment from the mechanism that verifies the payment. Eftsure, which now offers vendor verification across more than 200 countries including South Korea, describes its approach as replacing email and phone-based controls with multi-layered verification. The broader principle matters more than any individual solution. If AI makes impersonation cheap, verification cannot remain an expensive manual process.
Why This Matters for Korean Companies
The issue is particularly relevant to Korean enterprises with extensive supplier and international payment networks. Semiconductor manufacturers, automotive companies, electronics groups, shipbuilders and global consumer businesses routinely interact with suppliers and partners across multiple countries. As those networks become more geographically distributed, independently confirming payment instructions can become more difficult because of different banking systems, languages and time zones.
That creates a widening gap between the speed at which legitimate businesses need to move money and the time required to establish that a payment request is genuine.
Technology will therefore have to reduce that friction. AI can help analyze payment patterns, identify anomalies and prioritize high-risk transactions. But companies should be careful not to make AI-generated identity signals another unquestioned source of trust. A convincing synthetic voice or video is still only a communication. The stronger architecture is one in which the payment can be independently verified regardless of how convincing the request appears.
South Korea’s response to financial fraud shows that the country is moving toward more coordinated, data-driven defenses. ASAP’s results demonstrate the potential of sharing intelligence across institutions, while the expansion of the system into financial, telecommunications and investigative data is pushing that model further. But AI is changing the economics of deception faster than organizations can change their habits.
The next challenge is therefore not simply teaching employees how to spot deepfakes. It is redesigning payment workflows so that being convincing is no longer enough to get paid. That may be the central security equation for the AI era. If attackers can automate impersonation, businesses will need to automate verification. The companies that manage that transition will not necessarily be those that become best at identifying fake people. They will be those that make identity independent of the communication channel altogether.
