South Korea’s Ministry of Science and ICT has confirmed that mandatory facial recognition for new mobile phone number registrations will take effect on March 23, 2026, following a pilot that began earlier this year. The policy is drawing formal opposition from civil society organizations who argue it violates the country’s own data protection law and international human rights standards.
The requirement applies to all three major mobile carriers and virtual network operators. When signing up for a new number, customers must submit to real-time facial recognition that compares their face against the photo on their ID card. The Ministry says the system will prevent “daepo-phones” — illegally registered handsets used for voice phishing — by making it impossible to activate a line under a false identity. South Korea recorded more than 21,000 voice phishing cases in 2025 alone.
Open Net Korea, joined by four other civil society organizations, issued a joint statement in January calling on the government to scrap the mandate. The coalition argues that facial biometric data is uniquely sensitive because it cannot be changed if compromised, and that requiring it as a condition for accessing a basic communication service removes any meaningful element of free consent, putting the policy in conflict with the Personal Information Protection Act. The statement also challenges the government’s fraud-prevention rationale directly, pointing to China’s experience: a similar SIM facial recognition mandate introduced in 2019 was eventually abandoned after contributing to large-scale data leaks without demonstrably reducing fraud.
The civil society groups contend that voice phishing in South Korea is primarily fueled by the mass leakage of resident registration numbers caused by corporate and government data handling failures, and that mandating more biometric collection shifts the security burden onto citizens rather than addressing the root cause. They have called instead for stronger corporate liability for data breaches and reform of the centralized personal data verification system.
The policy rollout follows a significant breach at SK Telecom in April 2025, in which SIM card data belonging to nearly 27 million subscribers was stolen. Privacy regulators found the company had failed to implement basic access controls. The breach gave political momentum to the facial recognition mandate, but critics argue it illustrates exactly why building larger centralized biometric databases is the wrong response to telecoms security failures.
The SIM registration policy is one of several biometric anti-fraud initiatives South Korea has advanced in recent years. South Korea had previously explored mobile facial verification to combat SIM-swap and voice-phishing abuse, and Toss’s FacePay biometric payments service has reached one million users as consumer adoption of facial authentication grows in the market.
Sources: Open Net Korea, The Record, Commsrisk
–
By the ID Tech Editorial Team
