Naver Pay

Is Naver Pay safe?

Naver Pay is a reasonable choice for paying online and in shops in Korea. It has no large fine, and nothing like the case that saw Kakao Pay send data on 40 million users to an Alipay company. Its record is a string of smaller problems: two small fines for leaving internal systems connected to the internet, a 2021 error that showed about 100 members' asset details to other users, and a four-hour payment outage in February 2026.

We score Naver Pay 61/100, ahead of Kakao Pay (54) and Toss (58), and behind Samsung Wallet at 67.

What the regulators found

Korea's Financial Supervisory Service (FSS) has fined Naver Pay's operator twice, both times for security controls. In July 2019, before Naver Pay moved into its own company, it fined Naver Corp. KRW 30 million: staff computers linked to the internal network could reach the internet, and terminals that connect straight to data-centre systems were only logically, not physically, separated.

In November 2021, it fined Naver Financial KRW 23.6 million and cautioned three executives. The findings were similar. Some internal systems, and a system that stored the query history for the whole database, could be reached from the internet. Naver Financial had also changed a number of ledger records without a second person checking them, and had not told users about a change to its terms a month in advance.

In August 2024, after the Kakao Pay case, the FSS began on-site inspections of Naver Pay and Toss to check for unconsented transfers to overseas partners. The only Naver Financial sanction published since, on 10 July 2026, was a caution for one employee: the company had not run customer checks on the firm that settles overseas payments under a 2021 partnership. That is a money-laundering control, not a privacy finding.

What Naver Pay collects

Apple's label on the Korean App Store lists identifiers and usage data as used to track you across other companies' apps and websites. Financial information, contact details, identifiers and diagnostics are linked to you. Location, contacts and some usage data are collected without being linked to your identity.

The privacy policy is long, because Naver Pay is more than a checkout. It covers loans comparison, insurance, a MyData asset view, rental deposit guarantees and FaceSign, which lets you pay with your face. Three points stand out. Naver Pay collects the advertising ID for behaviour-based ads and runs a reward-ad service on it. It may use pseudonymised data for statistics, including commercial market research. And Naver Corp. processes data for Naver Pay, including data analysis and statistics.

On sharing, the policy is clearer than most. It says Naver Pay gives data to an outside partner only when you use that partner's service, after showing you who gets what and asking for your consent, and that it does not send data on users who never used the service. That consent step does not cover the pseudonymised statistics above, which Korean law allows without consent.

Outages and the 2021 data exposure

On 28 December 2021, while moving its "My Assets" feature to Korea's MyData system, Naver Pay showed about 100 members' asset details to other members. Naver Financial apologised to each one and paid them in Naver Pay points.

On 19 February 2026, points and Naver Pay Money payments failed from noon for more than four hours. Online orders, in-store payments and the Naver Pay Money card were affected; registered credit and debit cards kept working. The company reported the incident to the FSS and said it was not caused by an outside attack and no personal data leaked.

Naver runs a group-wide bug bounty programme, but we could not confirm from its public pages that Naver Pay is in scope.

How to use Naver Pay safely

1. Keep a registered card in Naver Pay as a backup, because the 2026 outage hit points and Money balances but not cards.
2. Pay only through the Naver Pay checkout on a shop's real website, never through a payment link sent by message.
3. Use a Naver Pay password you do not use anywhere else, and protect the Naver account that controls the wallet with a strong, unique password.
4. On iPhone, turn off app tracking under Privacy & Security; on Android, delete the advertising ID.
5. Read the consent screen before you link a loan, insurance or MyData partner, because that is when data leaves Naver Pay.

How we scored it

The regulatory record (74) is the strongest factor: two small security fines and no privacy penalty. Privacy (52) is the weakest, because the App Store label lists identifiers used for tracking and the policy allows ad targeting and commercial statistics, although partner sharing is limited to services you use. Security (64) reflects the 2021 exposure, repeated network-separation findings and an unconfirmed bug bounty.