Why Do Korean Websites Require Phone Identity Verification?

Korean websites require phone identity verification because, in Korea, a mobile phone account is not just a number. It is registered under a real name and linked to a resident registration number for Koreans or a foreigner registration number for long-term residents, so confirming control of that phone is treated as confirming who you are. Services use it to open accounts, recover passwords, confirm payments, book tickets and prove age or identity for regulated transactions. If your phone is a tourist SIM registered only with a passport, the chain ends there, which is why the same screen that takes a Korean resident seconds can stop a visitor completely.

Term	What it means
본인인증 bonin-injeung	Identity verification, literally “confirming the person”
휴대폰 본인확인	Phone-based identity verification via your mobile carrier
PASS 패스	The carriers’ verification app, used instead of an SMS code
주민등록번호	Resident registration number, the Korean citizen ID number
외국인등록번호	Foreigner registration number, on a Residence Card (formerly ARC)
실명 가입 silmyeong gaip	Real-name registration of a phone account

Is this the same as a two-factor login code?

A mobile phone carrier store interior in Seoul with blurred screens

No, and the difference is the whole point.

A two-factor code proves you hold a device or number. Korean phone identity verification proves something stronger: that the name and registration number you typed match the subscriber record your mobile carrier holds for that number, and that you can receive the code or approve the PASS prompt sent to it. The Korea Internet & Security Agency (KISA), which runs the national identity verification support portal, describes phone verification as an alternative means of identification built on the phone you own and the carrier’s subscriber record. KISA’s user guidance shows the standard flow: choose your carrier, enter your name, the first part of your registration number and your phone number, pass a captcha, then enter the SMS code, or approve in the PASS app, which can add biometrics.

So the phone is not the credential by itself. The credential is the carrier’s real-name file behind the phone, built when the account was opened with an ID document. Verification is a way for a website to borrow that check without collecting your full registration number itself.

Where did this system come from?

From two Korean decisions that long predate smartphones.

The first was a national ID architecture. Koreans carry a resident registration number used across banking, health insurance, tax and administration, and foreigners staying long-term receive a foreigner registration number in the same system. Once one number anchors a person’s official identity, other institutions tend to build on it rather than invent their own.

The second was a series of online real-name experiments. From 2007, Korea required large websites to verify commenters’ real identities using resident registration numbers, an anti-abuse measure expanded in 2009. The Constitutional Court struck that requirement down unanimously on 23 August 2012 as an excessive restriction on expression and privacy, and the provision was deleted in 2014. But striking down mandatory real-name commenting did not end identity checking. It moved it: the law now restricts ordinary websites from collecting resident registration numbers at all, and instead routes identity confirmation through designated verification agencies and alternative means, of which the carrier-based phone check became the everyday default.

That history explains the screen’s stubborn shape. Korea tried collecting ID numbers directly, was told by its own court that it could not do that so broadly, and settled on asking the phone companies, who already hold the match between a person and a number.

Why do shops, banks and ticket sites all use the same wall?

Because for each of them, an anonymous account is a cost they have already decided not to carry.

Commerce and finance need a recoverable, legally identifiable counterparty for fraud, chargebacks, age-restricted goods, customs clearance and account recovery. Government and telecom-linked services need the same for benefits, bookings and records. A shared verification rail gives a small shop the identity assurance of a bank without building anything, and gives the user one memorised ritual instead of a new credential per site. The Korea Customs Service’s guide for overseas purchases shows how deep this runs: even receiving an international parcel smoothly involves a personal customs clearance code and identity authentication, with phone verification among the standard options.

There is also a network effect. Once almost every resident has a real-name phone, requiring it excludes almost nobody a Korean service was designed for, so services keep requiring it, so keeping a real-name phone stays close to mandatory for daily life. The system is self-reinforcing, which is why it feels less like a website feature and more like a door every building happens to share.

Why does it fail for so many foreigners?

A smartphone on a counter in Seoul during online checkout, screen blurred

Because the chain has three links, and a visitor usually holds only one of them.

Verification needs, first, a Korean phone number; second, that the number is registered under your real name; and third, that the registration number on the carrier’s file matches the name and number you type. A Korean national’s file holds a resident registration number. A long-term foreign resident’s file should hold a foreigner registration number, but only after the carrier account has been updated with the Residence Card details, a step that does not happen automatically when the card is issued. Until that update is made at a carrier store and the record syncs, verification fails even though the phone works.

A short-term visitor has no registration number in the system at all. An airport or tourist SIM bought with a passport can receive calls and data, and can even receive an SMS, but there is no resident or foreigner registration record behind it for the carrier to match. The code arriving is not the problem. The missing file is. KISA’s own guidance frames phone verification around an identity number, and the customs authorities’ English FAQ makes the same point from the other side: the name on the order, the phone subscriber name and the identity record have to agree.

This is also why “my Korean friend did it for me” creates a second problem. Verifying under another person’s phone registers the account, purchase or booking to that person, which can break refunds, ticketing, warranty and customs records later.

What can a foreigner actually do?

If you live in Korea: after receiving your Residence Card, visit your carrier’s store and have the account re-registered against your foreigner registration number, using exactly the name spelling on the card. Then test a low-stakes verification before you need one for banking or a delivery deadline. Name-order and spacing mismatches are a common cause of failure.

If you are visiting: expect some Korean-only checkouts, bookings and services to be unreachable, and plan around them rather than at the airport. Use international versions of platforms where they exist, pay with options a service explicitly offers to non-residents, book through hotels or agencies for identity-gated tickets, and do not build an itinerary that depends on a Korean resident-only reservation opening. Rules differ by service and change, so check the specific service’s current foreign-user guidance before paying for anything non-refundable.

Either way: treat a request to borrow someone else’s verification as a warning sign, not a workaround.

What are the trade-offs?

What the system does well. For residents it is fast, memorised, and does not scatter copies of a national ID number across every shop’s database. It gives small merchants bank-grade identity assurance, makes account recovery simple, and ties fraud to a real subscriber. Compared with uploading ID documents to dozens of sites, asking carriers to confirm a match is a comparatively contained design.

What it costs. It makes a commercial phone account a de facto identity document, so anyone outside the registration system, tourists, new arrivals, some people whose records mismatch, is excluded from ordinary commerce rather than merely inconvenienced. It concentrates a lot of daily life in carrier records and a few verification agencies. It also confuses two different things, holding a phone and being a verified person, in a way that only becomes visible when the second is what a website actually wants.

And the unresolved tension. Korea’s own Constitutional Court rejected broad real-name verification for speech in 2012, yet identity verification for transactions kept expanding because fraud and administration kept demanding it. The current system is the compromise between those two pressures: no ID numbers collected by websites, and a phone check standing where the ID number used to be. Whether PASS-style app verification and newer certificates soften the foreigner problem depends on whether they create a route for people with no registration number, not only a smoother route for people who already have one.

FAQ

Can I verify a Korean account with a tourist SIM?

Usually no. A passport-only tourist SIM can receive SMS codes, but Korean identity verification also needs the carrier record behind the number to hold a resident or foreigner registration number matching your name. A tourist SIM has no such record.

What is PASS in Korea?

PASS is the mobile carriers’ identity verification app. Instead of typing an SMS code, you approve a prompt in the app, sometimes with biometrics. It checks the same carrier subscriber record as SMS verification.

I have a Residence Card. Why does verification still fail?

Usually because your carrier account still holds your passport registration or a different name spelling. Visit a carrier store, re-register the account against your foreigner registration number exactly as printed on the card, allow time for the record to update, then try again.

Why do Korean sites ask for verification just to buy something?

Because commerce, payments, age-restricted goods and customs clearance are built on identifiable customers in Korea, and phone verification is the shared way to establish that without each site collecting registration numbers directly.

Can I use a Korean friend’s phone number to verify?

Technically the code may arrive, but the account or purchase is then registered to your friend, which can break refunds, tickets, deliveries and records. Services also treat using another person’s identity verification as misuse.

The structural answer

Korean websites do not really trust your phone. They trust the file your phone company opened when you proved who you were to get the number, a file anchored to the same registration number that anchors banking, health insurance and tax. The verification screen is a small shop borrowing the state’s and the carriers’ identity check because building its own was made legally and practically unattractive. For the roughly whole resident population inside that file, the result is a few taps. For everyone outside it, the same few taps are a wall, and the wall is not a bug in the checkout. It is the boundary of the system itself.