Kakao Pay

Is Kakao Pay safe?

For moving money, mostly yes. Kakao Pay holds Korea's ISMS-P certification, runs a 24-hour security operations centre, and we found no report of a breach. The problem is what the company itself did with user data. Korean regulators found that from 2018 to May 2024 it sent data on all of its about 40 million users to a Singapore company in the Alipay group, without asking them. The Financial Supervisory Service counted 54.2 billion items.

That case produced a KRW 5.97 billion privacy fine in January 2025 and a further KRW 12.98 billion penalty from the Financial Services Commission in February 2026. Kakao Pay is fighting both in court. We score Kakao Pay 54/100, close to Alipay at 50 and well below Samsung Wallet at 67.

What happened with Kakao Pay and Alipay

The transfers started with Apple. To accept Kakao Pay in the App Store, Apple wanted a "non-sufficient funds" (NSF) score, a customer-level estimate of how likely a payment is to fail, and it had hired Alipay to calculate it. Kakao Pay supplied the data. The PIPC lists 24 kinds of user-specific numbers, including hashed customer numbers, phone numbers and email addresses, plus the date you joined, your balance and how often you topped up, paid and sent money in the past week. Kakao Pay sent full user extracts three times in 2018 to build the model, then data on about 40 million users every day from June 2019 to May 2024.

The Personal Information Protection Commission (PIPC) announced on 23 January 2025 that the transfers needed users' consent. It fined Kakao Pay KRW 5.97 billion, fined Apple KRW 2.4 billion, and ordered Alipay to destroy the scoring model. Fewer than 20% of the users concerned had set Kakao Pay as an Apple payment method, yet Android users were sent too, a point the Seoul Administrative Court cited when it upheld the fine in June 2026. Kakao Pay has appealed.

Kakao Pay's position is that it outsourced a fraud check, sent the data hashed and encrypted, and confirmed with Alipay that nothing was used for marketing. The court was not persuaded. It said users could not be taken to have agreed to their data becoming a credit-assessment metric for Apple.

The ownership link is worth knowing too. In 2024, Alipay Singapore Holding, part of Ant Group, was Kakao Pay's second-largest shareholder with a 32.06% stake.

What Kakao Pay collects

Kakao Pay is more than a wallet. One app covers transfers, payments, bills, loans, insurance and investing, and the privacy policy reflects that. Required data includes your name, date of birth, phone number and carrier, email, gender, nationality, Kakao account and Korea's CI and DI identity codes. For enhanced customer checks it can also take your resident registration or driving licence number.

The policy also allows targeted advertising. It collects your phone's advertising ID, the pages you visit and your searches for up to a year, and lets advertising companies collect behaviour data in the app. Apple's label gives a narrower picture: only usage data is marked as used to track you, and only contact information is linked to your identity. A payment app that verifies your identity cannot keep your financial data unlinked from you, so we score privacy on the policy.

How Kakao Pay protects your account

Beyond ISMS-P, Kakao Pay lists ISO/IEC 27001 and 27017 certifications, and its privacy policy adds PCI-DSS for card data. It says it runs a security operations centre around the clock, yearly vulnerability assessments across its services, and internal and external penetration tests.

What we could not find is a public bug bounty. Kakao's group-wide programme specifically excludes the Kakao Pay API. Reliability has also suffered. Transfers and payments stopped for a few hours after the October 2022 data-centre fire covered on our KakaoTalk page. Kakao Pay moved to its disaster-recovery centre, and most services were back from 7 pm that day.

Scams to watch for

The main danger is not the app but people using it. Messenger phishing is common in Korea. A fraudster messages you on KakaoTalk pretending to be your child or a friend with a broken phone, then asks for a quick transfer. Kakao Pay sends money in seconds, so the window to stop it is short.

1. Call the person on a number you already know before you send money to someone who claims to be family.
2. Never install an app or share a verification code because a caller or message asks you to.
3. Use a Kakao Pay password that differs from your phone PIN and from any code you use elsewhere.
4. On iPhone, turn off "Allow Apps to Request to Track" under Privacy & Security, which blocks the advertising ID Kakao Pay uses for targeted ads.
5. Check the overseas transfer list in the privacy policy, which names the companies abroad that receive your data.

How we scored it

Security (70) is the strongest factor: certified, monitored and with no known breach, but without a public bug bounty. Privacy (38) is the weakest, because the Alipay transfers covered every user for almost six years and the policy allows ad tracking the label does not fully show. The regulatory record (45) reflects two penalties for the same conduct, about KRW 19 billion in total, with the first upheld in court.