PASS is the identity-verification app jointly run by Korea’s three mobile carriers, and by 2026 it’s close to mandatory — you need it to open a bank account, sign a phone contract, or check in at a clinic. Skip it, and huge parts of Korea’s digital and physical life quietly lock you out.
My cousin flew in from Toronto last month, and before she landed I told her, breezily, “just download PASS, you’ll be fine.” I had to walk that back twice in one day — once at a phone shop, once trying to sign her up for a streaming account — because being fine required something I’d forgotten she didn’t have yet: a Korean phone plan with her real name on it.
What Exactly Is PASS, and Why Does Every Korean Carry It?
PASS isn’t a wallet app or a messaging app — it’s pure infrastructure. It’s the joint identity-verification service built by SK Telecom, KT, and LG U+, Korea’s three carriers, and its entire job is real-name verification, or bon-in injeung (본인인증, literally “confirming it’s really you”). Every time a Korean website asks you to prove you’re an adult, a real person, or the actual owner of a phone number, PASS is usually the tool quietly doing that handshake in the background.
The adoption numbers back up how normal this became, and fast. PASS passed 35 million verified users by August 2021 — a base that roughly matches Korea’s entire working-age population. That’s not 35 million downloads sitting untouched on people’s phones. It’s 35 million people who, at some point, needed the app badly enough to actually set it up.
Why Didn’t Any of This Exist Before 2020 — and What Changed?
For most of the 2000s and 2010s, Korean banks and government sites ran on a different system entirely: the accredited certificate (공인인증서, gong-in injeung-seo, literally “officially authorized certificate”), a clunky digital-signature file that was, by law, mandatory for anything sensitive online. I’ve written before about the mess that created — a post I did a while back was literally titled “Korea Finally Killed Internet Explorer — But Try Using a Korean Bank on a Mac,” because the certificate system had locked so much of Korean banking to IE and ActiveX that the browser refused to die long after the rest of the world moved on.
The certificate’s legal monopoly didn’t end on its own. Korea’s 2020 Electronic Signature Act amendment abolished it, effective December 10, 2020, opening the field to private authentication providers for the first time. PASS is essentially what rushed into the vacuum that left behind. It’s the direct answer to the IE problem — not by fixing IE, but by making the certificate system optional so an app-based alternative could exist at all.
That single legal change is why your bank login looks completely different today.
When Did PASS Become an Actual ID, Not Just a Login Tool?
PASS didn’t stop at logins and payments. It kept expanding until it became something closer to a second wallet. Mobile resident-registration-card verification — a digital version of the resident registration card (주민등록증, jumin-deungnok-jeung, Korea’s national ID card) — officially launched on the PASS app on November 10, 2022. From there, adoption moved fast: PASS’s mobile-ID services, covering both the mobile driver’s license and the mobile resident card, passed 10 million subscribers by May 30, 2024.
| Dec 10, 2020 | Electronic Signature Act amendment ends 공인인증서’s legal monopoly |
| Aug 2021 | PASS passes 35 million verified users |
| Nov 10, 2022 | Mobile resident-registration-card verification launches on PASS |
| May 30, 2024 | PASS mobile-ID services pass 10 million subscribers |
| Apr 19, 2025 | SK Telecom discovers malware behind Korea’s largest telecom data breach |
| Late Dec 2025 | Carriers add facial biometric checks to new phone sign-ups |
Why Did Verification Get Even Stricter in Late 2025?
Then came the breach that made the whole system feel less like convenience and more like exposure. In April 2025, SK Telecom suffered Korea’s largest-ever telecom data breach. Malware was discovered on April 19, and investigators found that as much as 9.7GB of USIM-related data — IMSI identifiers tied to roughly 27 million phone lines — had been exposed. SKT itself acknowledged that its full base of roughly 25 million subscribers could be affected, which is the kind of sentence that makes you go check your own SIM card twice.
The company started free USIM replacements on April 28, and for a while, some banks temporarily suspended SKT-based phone identity verification altogether — meaning the very tool people used to prove who they were had, briefly, become a reason banks trusted them less.
That’s not a small irony.
Following the breach wave, Korea’s three carriers moved to add facial biometric verification, checked against the photo already stored in PASS, for anyone opening a new mobile phone account. The goal, reported as of late December 2025, is blocking stolen-ID phone lines from being used in voice-phishing scams — a problem serious enough that carriers decided a password and a resident number weren’t proof enough anymore. Your face is now part of the paperwork.
So What Did My Cousin Actually Need?
Here’s where my breezy advice fell apart. PASS verifies you through your mobile carrier, which means it needs a Korean phone plan already registered in your real name — not a tourist eSIM, not a prepaid data-only SIM bought at the airport. My cousin had the second kind. She had a phone number, technically, but not the kind of number PASS, a bank, or a phone shop clerk considered “real” enough.
So the actual fix wasn’t downloading an app. It was getting her a postpaid plan under her own name first — passport in hand, at a carrier store, patience required — and only after that did PASS start working the way I’d promised it would. I felt a little sheepish explaining that part, honestly, since I use PASS on autopilot every single day without ever thinking about what it’s built on top of.
She’s back in Toronto now, PASS still installed on her phone for reasons neither of us can fully explain. I still catch myself, most weeks, tapping through a face-scan or a one-time push notification without a second thought — until someone visiting reminds me how much infrastructure is quietly humming under that one tap. If you’re planning a longer stay in Korea yourself, get the phone plan sorted before you assume the app will just take care of the rest.