Toss

Is Toss safe?

Toss is safe to pay and send money with, but it has a weaker record on how it uses your data. Its operator, Viva Republica, holds Korea's ISMS-P certification, pays researchers up to KRW 30 million per bug, and we found no breach of its own systems. In October 2024, though, the Financial Supervisory Service (FSS) sanctioned it for using personal credit data without consent, with a KRW 5.374 billion penalty surcharge and a KRW 628 million fine.

We score Toss 58/100. That puts it ahead of Kakao Pay at 54, whose data case was far larger, and well behind Samsung Wallet at 67.

What the FSS found

The main case was a data experiment. Between November 2021 and April 2022, Toss received about 29.28 million transaction records from an e-receipt company and matched them directly against its own members' card transactions to analyse a business idea. Korea's Credit Information Act requires consent for that kind of use and says that joining your data with another company's data must go through a licensed data agency. Toss did neither.

The FSS listed more problems:

• When people signed up, Toss presented items that were optional as required, and about 4.63 million members agreed to them.
• In 2022 it stored insurance details for 274 people who had declined consent, and used them 2,102 times in its insurance lookup service for those same users.
• Access logs for its Hadoop data system were not backed up to separate storage, and in April 2022, 261 employees had the same lookup rights whatever their job.

The sanction was the largest the FSS gave any financial firm in 2024. It was not Toss's first: in March 2021 the FSS fined it KRW 37.2 million for running systems in the cloud without the required procedures and for not physically separating data-centre terminals from the internet. In 2025, a lawmaker released FSS papers showing that the inspectors had asked for a three-month suspension for chief executive Lee Seung-gun and other executives. The sanctions panel cut that to a cautionary warning, after counting 64 data joins as the violations rather than 29 million records.

What the Toss app collects

Toss is a super-app. One login covers transfers, payments, a credit score, insurance, loans, stocks and a growing list of side services, so it holds a lot. Apple's label on the Korean App Store lists nine kinds of data linked to you: financial information, contact details, contacts, identifiers, location, usage data, diagnostics, health and fitness data and "other". Usage data is marked as used to track you across other companies' apps.

The privacy policy confirms behaviour-based ads. Toss analyses the services you visit, how often you use them and what you enter, collects your phone's advertising ID, and uses this to tailor services "including ads". It says it does not show targeted ads to children under 14. Face Pay, which lets you pay at a terminal with your face, stores face templates until you leave or withdraw consent. Since 19 October 2023, Toss no longer deletes or separates the data of long-inactive customers.

How Toss protects your account

The certifications are solid: ISMS-P, ISO/IEC 27001 and 27701, and PCI-DSS for card data. Its Global CBPR privacy certificate ran until 28 October 2026, and in early November 2026 Toss was not in the CBPR directory. Toss lets you choose between three levels of password protection, and you can hide balances on the home screen with one tap. Its bug bounty covers the Toss app gateway and sister firms such as Toss Bank and Toss Securities, with rewards of up to KRW 30 million per vulnerability.

The one known misuse came in June 2020. Fraudsters entered stolen names, phone numbers, birth dates and Toss passwords on the web checkout of three online shops and spent about KRW 9.38 million in a few customers' names. Toss said it was not hacked, refunded the money the next day, checked every payment at the affected shops and added an app check to web payments there.

In September 2026, sister company Toss Payments, which handles card checkout for online shops, said someone used a connection key exposed on one merchant's website to view 4,131 payment records of 2,671 buyers. The records held names and masked card numbers, not passwords or CVCs. Toss Payments said its own systems were not breached and the Toss app was not involved, and the FSS is inspecting the case.

How to use Toss safely

Scams, not the app, take most of the money. Voice phishing and fake-relative messages are common in Korea, and a Toss transfer lands in seconds.

1. Use the fraud check Toss shows before a transfer, and stop if the account is flagged.
2. Call a relative on a number you already have before you pay a "new phone" request.
3. Never share your Toss password or a verification code with a caller, even one who claims to be from Toss, a bank or the police.
4. Choose the highest password level in the security settings, and do not reuse the password elsewhere, because the 2020 payments used details leaked from other sites.
5. Review the consents you have given under settings, terms and privacy consent, and withdraw the ones you do not need.
6. On iPhone, turn off "Allow Apps to Request to Track" under Privacy & Security.

How we scored it

Security (68) is the strongest factor: certified, with a paid bug bounty and no breach of its own, held back by the logging and access faults the FSS found. Privacy (45) is the weakest, because Toss joined millions of receipt records to card data without consent and the label shows ad tracking. The regulatory record (56) reflects one mid-sized penalty of about US$4.4 million, under half of what Kakao Pay faces over its Alipay transfers, plus a small security fine in 2021.