How Korea Knows It's You

🔒The hole left by the resident number#

What a ban created

Korean online verification was designed around the resident registration number. One number identified a person, which made checking simple and leaks expensive. When collecting it online was banned in 2012, a hole opened in the middle of every sign-up form. Every method in use now exists to fill that hole.

The 2012 ban#

No new collection, two years to purge

An amendment to the Network Act barred websites from newly collecting resident registration numbers from 18 August 2012. Numbers already held had to be destroyed after a two-year grace period. Across the industry, member databases had their number column pulled out at roughly the same time.

The phrase alternative means#

What stands in for the number

The same law that closed one door opened others: phone verification, i-PIN, credit cards, and certificates. They are called alternative means because the thing that used to sit in that slot was the resident registration number. Each certifies a different range, so a service picks one to match its own risk.

The number did not disappear#

It only left the web

The resident registration number itself was never abolished. Where a statute provides a basis it is still used, and banks, hospitals, and government counters still ask for it. What was banned is collecting it online without that basis. So the same person is checked by phone on a screen and by number at a counter.

🏛️The designated seat#

Who is allowed to vouch for you

An alternative means only works if someone certifies that this is the person. That someone cannot be just anyone; it has to be a designated body. Only designated bodies may keep handling resident registration numbers, and other services borrow their verdict. This is the real centre of Korean identity verification.

Who does the designating#

The KCC and Article 23-3

Identity verification bodies are appointed by the Korea Communications Commission under Article 23-3 of the Network Act. Designation lets a body issue and manage alternative means, in exchange for review of its safety and technical standards. Because designation is market entry, the review itself works as policy.

Where the carriers sit#

They already hold the number and the name

Mobile carriers verify a subscriber with an ID document at sign-up and keep managing that number afterwards. They already hold the raw material for verification, which is why phone verification is the most used alternative means. Choose it and the carrier matches your name and date of birth behind the screen. Lose the number and you lose the route.

i-PIN and credit cards#

Two attempts to check without the number

i-PIN is an internet-only identifier built to stand in for the resident registration number. Credit card verification borrows the identity a card issuer already confirmed. Both survive as detours for people without a phone, or whose phone is in someone else's name. Issuing and managing them is fiddly, so they usually sit lower on the list.

📜The day certificates split#

One thing became many

On 10 December 2020 the fully revised Digital Signature Act removed the accredited certificate's privileged legal standing. Once the mandatory single option opened up, authentication split into several branches. Names, issuers, and storage all differ, which is why people still stall in front of the choice.

From accredited to joint#

The standing went, the name changed

The old accredited certificate was not scrapped; it is still issued under the name joint certificate. What changed is that the law no longer recognises it alone. It now stands in the same line as everything else, and banks and government sites still use it. Without knowing about the renaming, the two look like different objects.

The financial certificate#

Stored in the cloud, not on the device

The Korea Financial Telecommunications and Clearings Institute released this certificate in December 2020. Instead of sitting as a file on a USB stick or a hard drive, it is kept in the issuer's cloud and fetched when needed. The practical difference is that changing devices requires no migration. It sits beside the joint certificate on bank screens, which is why the two get confused.

Simple authentication#

A consumer app stands in for a certificate

Apps people already use, from Kakao and Naver to carrier apps, become the authentication method. Public sites are open to them too, so on Government24 you log in by tapping a push notification. Nobody manages a certificate file any more; in exchange, the security of that app account becomes the security of the login.

🏦Finance has its own rulebook#

One check does not open an account

Financial transactions carry a separate demand called real-name verification. Passing an online identity check does not open an account. To open one without visiting a branch you have to stack the methods the Financial Services Commission laid down, and that rule shaped the sign-up screens of Korean fintech.

Two of five#

The grammar of non-face-to-face verification

From December 2015 an account could be opened without visiting a branch. The condition is stacking at least two of five methods: submitting a copy of an ID, a video call, verification while handing over access media, verification through an account already open, and anything equivalent. That is why app sign-up runs through so many steps.

What the one-won transfer does#

An account reused as a check

When an app sends one won to your account and asks what the depositor name says, that is verification through an account you already hold. Real-name verification was done when that account was opened, so the result is borrowed. Hence the pattern where the first account is hard and the second one is easy.

What MyData changed#

From checking to connecting

When the personal credit information management business took full effect in January 2022, scattered financial records could be pulled into one app. Here verification stops being only a door and becomes the starting point of consent about whose data goes where. That is where the purpose shifts from identity to permission.

🛂Where foreign residents get stuck#

Same screen, different outcome

The whole structure was built with a resident registration number holder as the default. A foreign registration number looks similar in shape, but systems differ on whether they accept it. So foreign residents meet a different outcome on the same sign-up screen, and the screen never says which step failed.

The phone contract comes first#

Verification starts at the carrier

Phone verification only works when the number is in your own name. A number opened under a company or a family member fails because the names do not match. This is the trap newcomers hit most often, and it is resolved at a carrier shop rather than on the verification screen.

The mobile foreign registration card#

A route opened in 2025

The Ministry of Justice began issuing mobile foreign registration cards on 10 January 2025. You apply at an immigration office and receive it in the Ministry of the Interior and Safety's mobile ID app. Identity can be shown without producing the physical card, and as this route widens the starting point of verification moves from carriers toward state-issued ID.