Why Korean Banks Suck

Banks falling behind on tech is a familiar story in the U.S., but I'm confident Korea takes it to the next level. To check your balance, you install seven different programs and plugins that run all the time and slow your computer down. To make any transaction, you create a digital certificate file you can't export.

Where it all began

It starts with the Export of cryptography from the United States. In 1999, with the internet booming, Korea couldn't properly use 128-bit AES encryption, so it started with a weakened 40-bit system. Later it built its own 128-bit system that needed ActiveX and made that the standard (SEED).

The U.S. lifted the export restrictions in 2000. Korea kept SEED and ActiveX anyway. ActiveX eventually went away, replaced by mandatory .exe security programs that run on your device all the time. As Wladimir Palant found out, these programs are a pain to use and don't even follow ancient security practices. They're built with a 15-year-old Visual Studio, causing avoidable security problems like simple Buffer Overflows Attacks. But why? Why aren't they fixing any of this? Here's what I see.

Dodging Responsibilities

Korean law says this.

A financial institution or electronic financial provider shall be responsible for compensating the user for damages caused by accident caused by forgery or alteration of an access medium, contract signing, or electronic transmission or processing of transaction instructions.

But some Korean banks figured out they could use the complexity of their security systems to push the blame onto customers after a breach. Add some very vague terms and conditions, and the bank points to them as proof that the customer knew the risks and agreed to take responsibility for any damage.

Limited Room for FDS

Unlike the U.S., which has a tipping system, Korean banks have no deferred transfer system by default. Every transaction is instant and irreversible. That makes a fraud detection system (FDS) much harder to run, because there's barely any time to catch and stop a fraudulent transaction before it goes through. A deferred transfer system like the one in the U.S. gives banks more time, since they can cancel or reverse a transaction before it's processed. Korean banks instead count on each customer to watch their own account for anything suspicious and report it. In other words, catching fraud is the customer's job.

Lack of Competitions

The Korean market is known for weak competition in some industries, banking included. A few reasons.

• Linguistic and regional barriers. Korean is a unique language, and many Korean consumers would rather deal with companies that speak Korean and get Korean culture.
• Resistance to external influence. Koreans have a lot of national pride and are often wary of outsiders playing a big role in their economy.
• Lobbying and Corruptions. There are corruption allegations against Korea Financial Telecommunications and Clearings (KFTC), one of five authorized certification companies, and it makes millions of dollars. KFTC is supposed to be a public interest organization set up by the state. Still, high-ranking Financial Services Commission officials are accused of colluding with it and landing jobs there after retirement. Makes you wonder why those seats are so attractive.
• Perception of overseas banks. Using an overseas bank or doing business with a foreign company is often seen as unpatriotic or unethical.

So banking, like the rest of the Korean market, doesn't get much competition.

Is there any hope?

Some. New fintech companies like Toss and KakaoBank have shaken up traditional banking with better digital products built around the customer, and Korean consumers finally have options. As fintech grows and people expect more, the old banks will have to adapt to keep up. There are still plenty of obstacles, but these new players show there's room for more competition and better banking in Korea.