South Korea began requiring stronger identity checks for all new mobile-phone activations on July 6, under a plan the Ministry of Science and ICT (MSIT) says targets the supply chain behind voice-phishing and so-called daepopong, the prepaid 'ghost phones' used to commit financial fraud.
Anyone signing up with a new carrier, or porting their number to a different one, must now clear an extra verification step on top of the standard ID check. Three options are available: facial recognition via the PASS app, which compares a live selfie against a government ID photo; the Ministry of the Interior's mobile ID app; or a resident-registration certificate issued the same day. Upgrading a handset on the same carrier requires no additional check.
The ministry says the biometric data used in facial recognition is deleted immediately after the match is made and is never stored. A security audit by the Korea Internet and Security Agency during the pilot period found no vulnerabilities, according to Seoul Sinmun.
The rollout is narrower than originally planned. MSIT had wanted facial recognition to be mandatory, but the Personal Information Protection Commission and the National Human Rights Commission both flagged the sensitivity of biometric data and recommended giving users a choice. The ministry accepted those recommendations and built the multi-option system instead.
Critics are not fully satisfied. Civil-society groups argue, according to Donga Ilbo, that most ghost phones in circulation are prepaid SIMs registered under foreign nationals whose identities are hard to verify, making checks on domestic users a limited fix. Technical concerns linger too: the pilot drew repeated complaints about recognition failures caused by poor lighting or awkward camera angles, prompting MSIT to push the launch back from March to July.
The government has mapped out further steps. August is earmarked for additional verification options that do not require a visit to a government office. A system to detect forged resident-registration certificates is set to connect automatically to the activation process in September. Amendments to the Telecommunications Business Act to give facial recognition an explicit legal footing are planned for October, followed in November by a default opt-in service that would let subscribers block any new lines being opened in their name.