Improve digital safety mechanisms

Recently, reports of Line account hacking have surged. On Sept. 9, Line announced that customer service reports related to such incidents in August had nearly doubled, increasing by 97 percent from July. Among these scams, requests to “vote for my child” and “help my pet get more votes” have become common ploys designed to exploit the trust of friends and acquaintances.

Victims lose access to their accounts, but the public response to these scams often questions whether they clicked suspicious links or gave out verification codes. If anti-fraud efforts only focus on victim blaming, platforms and telecommunications operators easily escape accountability.

In April, the Ministry of Digital Affairs revealed that the default password mechanisms for the voicemail accounts of former Taiwan Star Telecom Corp users could have potentially been exploited to obtain Line voice verification codes. This suggests that account hijackings might not necessarily stem from users giving out their information, but could also result from vulnerabilities in telecommunications services and platform verification systems. It is unacceptable for service providers to leave such significant security loopholes and expect consumers to patch them.

Line already offers a re-login feature that allows eligible users to recover their accounts and log out of all other devices. However, when the recovery process fails and the case is referred to customer service, Line still lists measures such as deleting the account and transferring paid items as the solution. If self-help is not an option, should there not be sufficient alternative verification methods and manual review processes for account recovery?

An account carries years of connections with family, friends and colleagues. Being able to recover only purchased sticker packages and having to rebuild contact lists from scratch is like having your home burglarized and being left with nothing but your house number, leaving you to rebuild your life on your own. Restricting account misuse and preventing impersonation is necessary, but that does not mean that victims of hacking receive adequate assistance.

Although the Ministry of Digital Affairs has urged service providers to address vulnerabilities and conduct security audits, repairing a system does not mean recovering users’ accounts, and a customer service reply does not mean the problem has been resolved.

The government should ask: How many people have successfully recovered their accounts? How long does it take? How many users were forced to create new accounts? If authorities only confirm that the vulnerability has been patched without getting answers to these questions, the losses suffered by victims might never appear in the final report.

The government should establish minimum service standards for account recovery, requiring clear reporting channels, tiered risk-based handling, manual review, reasonable response times and explanations for rejected recovery requests. Platforms need not guarantee that all data can be restored, but they should ensure that users with legitimate claims have a viable avenue for appeal. Verification procedures must also balance personal data protection with fraud prevention so as not to allow the recovery process itself to become another vulnerability.

The Ministry of Digital Affairs should continuously monitor Line and other platforms, requiring them to regularly disclose their account recovery outcomes, set deadlines for fixing procedural deficiencies and follow up on their progress.

Authorities should act as supervisors of digital security, not merely recipients of reports. Improving defenses requires verifying their actual ability to prevent account misuse and provide support to victims. People’s relationships and property should not be left to fill systemic gaps.