Why Does Korea Need Your ID for Everything?

Korea's Resident Registration Act dates to 1962. An early attempt to issue a national ID card in 1965 was abandoned after public opposition over cost and surveillance concerns — the system as most people know it today did not yet exist.

On January 21, 1968, a 31-man North Korean commando unit crossed the DMZ and infiltrated Seoul in an assassination attempt targeting President Park Chung-hee, reaching within roughly 100 meters of the Blue House before being intercepted — an event still referred to in Korea as the “1·21 Incident” or the Kim Shin-jo incident, after the one commando captured alive.

In the aftermath, the government fast-tracked a nationwide identification system explicitly to distinguish ordinary citizens from infiltrators and sympathizers. The first resident registration card was issued to President Park himself on November 21, 1968, followed by mandatory registration — including fingerprinting — for citizens aged 17 and older.

The system was built for a narrow, specific security purpose: telling a real citizen apart from someone who wasn't supposed to be there. Nothing about its original design anticipated it becoming the backbone of e-commerce checkout or mobile game age gates decades later — that expansion happened because the number already existed, not because anyone planned for it to be used that way.

Once every citizen carried a unique, government-verified 13-digit number, it became the path of least resistance for any institution that needed to confirm “is this a real, specific, adult person” — banks used it to open accounts, telecom carriers used it to register SIM cards, and later, websites used it for age verification and fraud prevention. Building an independent verification system was more expensive than plugging into the one the state had already made mandatory for everyone.

By the 2000s, the resident registration number had become a de facto master key requested by everything from game publishers enforcing age ratings to e-commerce sites doing fraud checks — a level of reach far beyond the original 1968 security rationale.

Using the resident registration number as a universal online identifier came under sustained criticism after breaches in 2011–2012 exposed millions of internet users' personal information, including their registration numbers.

In August 2014, a breach at three major Korean card companies (Lotte, NH, KB) exposed roughly 104 million data records tied to about 20 million people — meaningful in a country of roughly 50 million, since it implied a large share of economically active adults had their data compromised, in some cases more than once across separate incidents.

A 2014 legal amendment banned personal-information processors from collecting resident registration numbers based on consent alone, and introduced fines of up to ₩500 million for processors that fail to adequately protect them. Alternatives such as i-PIN and, later, carrier-based mobile verification were promoted as substitutes for typing your raw registration number into websites.

The reform changed the mechanism, not the underlying logic: the state-linked number is still treated as the trust anchor everything else builds on — it just moved one layer over, from the resident registration number itself to a mobile phone account that is, in turn, tied to that same number.

Today, carrier-based mobile identity verification (the PASS app is the dominant provider, with separate versions for SKT, KT and LG U+) is the default real-name check for online banking, government portals, hospital registration, digital contracts and mobile payments.

For a foreign resident, verification depends on a Alien Registration Card (ARC) number being linked to a registered postpaid account with a Korean carrier — a step that does not happen automatically when you buy a SIM, and commonly fails on a first attempt because the ARC number hasn't been separately registered with the carrier yet.

As of 2026, this verification is reported as no longer optional for the services listed above — meaning a foreigner who hasn't completed the ARC-to-carrier link isn't just missing one convenience feature, they can be unable to open a bank account, book a hospital appointment, or complete an online purchase at all. Separately, the PASS app has documented, unresolved issues verifying foreign names containing hyphens or apostrophes as of mid-2026.

This is the same underlying mechanism that AMS has documented elsewhere in narrower forms — why foreign payment cards fail at Korean checkout, why K-pop ticket sites reject overseas buyers — all of it traces back to the same root: a verification architecture built around an identity number Korean citizens are issued at birth, into which foreigners are a late, structurally awkward addition rather than a planned-for case.

1

Get your Alien Registration Card (ARC) before trying to open a bank account or buy a SIM plan — almost everything downstream depends on it

2

Get a postpaid Korean phone plan tied to your ARC, not a prepaid/tourist SIM — most real-name verification requires a registered postpaid line

3

Download the PASS app matching your specific carrier (SKT/KT/LG U+) — the wrong version will not verify you

4

If verification fails on a name with a hyphen or apostrophe, try your ARC name exactly as printed, not your passport spelling

Why does Korea have this system at all?

The Resident Registration Act dates to 1962, but the version that assigned every citizen a unique tracking number came after a specific security shock: in January 1968, North Korean commandos infiltrated Seoul in an attempt to assassinate the president, reaching within about 100 meters of the Blue House before being stopped. In the aftermath, the government fast-tracked a national identification system explicitly to distinguish citizens from infiltrators — the first resident registration card was issued in November 1968.

How did an anti-espionage law turn into a banking requirement?

Once every citizen had a unique verifiable number, it became the path of least resistance for every other system that needed to confirm "is this a real, specific person" — banks, telecom carriers, later online services, gaming age-verification and government portals all adopted it as their default identity key, because building a separate verification system was more expensive than reusing the one the state had already made mandatory.

Is the resident registration number itself still used online?

Less directly than it used to be. After breaches in 2011–2012 and a 2014 breach at three major card companies that exposed roughly 104 million records tied to about 20 million people, a 2014 law amendment banned collecting resident registration numbers based on consent alone and introduced fines of up to ₩500 million for processors that fail to protect them. Alternatives like i-PIN and carrier-based mobile verification took over much of the online role — but the underlying logic (a state-linked number is the trusted anchor) didn't go away, it just moved to your phone carrier.

Why does this specifically lock foreigners out?

Carrier-based verification (the PASS app is the dominant one) requires your Alien Registration Card number to be linked to a registered postpaid account with a Korean carrier — a step that doesn't happen automatically when you buy a SIM, and commonly fails on a foreigner's first attempt. As of 2026, this verification is no longer optional for online banking, government portals, hospital registration, digital contracts and mobile payments — so a foreigner who hasn't completed the ARC-to-carrier link can find themselves unable to do any of those things, not just one.