2017년 1월 16일 월요일

Improvement of Terms & Conditions of E-finance Transactions Unfavorable to Financial Consumers

Background

On December 15, 2016, the Financial Supervisory Service (FSS) issued a press release regarding its review of 480 terms & conditions of e-finance transactions currently used by 176 financial companies such as banks, securities companies, insurance companies, credit card companies and e-finance companies. According to the press release, the FSS (1) directed 156 companies to take corrective measures with respect to certain terms and conditions that are unfair and unfavorable to consumers, and (2) announced its plans to prepare the Standard Terms & Conditions for e-finance businesses to protect consumers.  

Terms and Conditions Requiring Corrective Measures

Set out below are the types of terms and conditions that the FSS found as unfair and unfavorable to customers and thus directed the relevant companies to take corrective measures. 

   One-sided terms and conditions unfavorable to consumers

-        Terms and conditions requiring consumers to take comprehensive liability for losses, including those not attributable to the consumers.

-        Terms and conditions requiring consumers to be liable for not immediately reporting the theft/loss of security access devices (e.g., secured tokens, OTPs, etc.).

-        Terms and conditions that, while the law requires financial companies to be liable for damage compensation for losses incurred due to the unauthorized use of secured access devices by third parties only upon receipt of report of theft/loss of secured access devices, leave consumers overall liable for damage compensation regardless of the timing of the report.

-        Terms and conditions that designate the regional court of the location of the financial company’s head office/branch office as the competent court of jurisdiction.  The FSS requested the regional court of the consumers address to be also included as the competent court of jurisdiction. 

   Terms and conditions that unreasonably limit the liability of financial companies

-        Terms and conditions that release liability of the financial company that was not the issuer of the security access device to the consumer whenever there is an unauthorized access using the security access device.  The FSS requested the financial company to bear liability regardless of whether the financial company issued the secured access device.

-        Terms and conditions that release liability of financial companies in e-finance transactions due to force majeure events (e.g., natural disasters, etc.).

   Terms and conditions that do not reflect the current regulations

-        Terms and conditions that require customers to use authentication certificates and one-time passwords while the requirement to use authentication certificates and one-time password has been repealed from the relevant laws and regulations. 

-        Terms and conditions that do not explicitly include hacking in the types of e-finance accidents for which financial companies are liable to compensate customers loss, as the Electronic Financial Transactions Act includes hacking as e-finance accidents.

Standard Terms and Conditions

The FSS is expected to review the ways to establish of the Standard Terms and Conditions for e-finance businesses and discuss with the Korea Fair Trade Commission (KFTC) by the first quarter of 2017.  Once the FSS and the KFTC prepare the Standard Terms and Conditions, they will likely recommend financial companies to use the Standard Terms and Conditions.  If e-finance businesses use terms and conditions that are different from the Standard Terms and Conditions, it must indicate the major differences from the Standard Terms and Conditions in a manner that customers can readily understand.

Best Regards,

Reentrancy Attack: 블록체인 스마트 컨트랙트의 치명적인 취약점

블록체인 기술이 전 세계적으로 주목받으면서 스마트 컨트랙트(Smart Contract)의 사용이 급격히 증가하고 있습니다. 하지만 그만큼 보안 취약점도 함께 늘어나고 있는데, 그 중에서도 Reentrancy Attack(재진입 공격)은 매우 치명적이고...