Passport Copy SIM Signups Expose Gaps in South Korea's Mobile Identity Checks

More than 71,000 phones registered under foreign names

South Korean police recorded more than 71,000 burner phones registered under foreign names in 2024, up from 474 cases in 2019. The increase has put mobile identity checks under scrutiny, particularly services that allow some foreign nationals to apply from overseas using a passport copy and activate their phones when they arrive.

People Power Party lawmaker Choi Hyung-du raised the issue after examining data obtained from the Korea Communications Commission. His office says essential checks for foreign subscribers are being left to individual companies, creating gaps that criminals can exploit.

One program offered by KT allowed people with certain work or study visas to register abroad for a 5G postpaid plan costing 36,575 won a month. Applicants in countries including Vietnam and Nepal could submit a passport copy before travelling and receive service immediately upon arrival in South Korea. A postpaid plan charges customers after they use the service, rather than requiring them to buy credit in advance.

Workers and students benefit from having a working number as soon as they land. The concern is whether a carrier can reliably establish who is applying before that number becomes active, especially when a broker collects the documents overseas.

Police investigations show how copied identity documents can support large criminal operations. Investigators identified 71 people linked to a scheme involving more than 11,000 SIM cards registered using passport copies belonging to foreign nationals living in Korea.

Voice phishing losses had reached about 800 billion won by July 2025, and authorities expected them to exceed 1.37 trillion won by the end of the year. Voice phishing involves fraudulent calls that trick people into handing over money or sensitive information. Numbers registered under someone else's identity help criminals conceal who is making those calls.

Why the identity check depends on the subscriber

South Korea requires identity verification for every new mobile subscription. For citizens and long term residents, retailers scan a government identity document and use an automated system to check for forgery. The system examines security features and information fields for signs of alteration.

Those checks provide a common starting point for mobile subscriptions, banking applications linked to phone numbers and the country's communications system, which connects accounts to real identities. A phone number can become part of the way a person accesses other services, making the initial registration more consequential than simply buying a SIM card.

Foreign nationals can encounter a less uniform process. The rules followed by carriers are less specific, and requirements vary between companies and individual shops. Many outlets accept a passport image and visually compare it with the customer, without digitally confirming that the document is authentic.

Some shops request additional paperwork; others do not. The strength of the check can therefore depend on where someone applies. Lawmakers want a common standard that makes identity verification less dependent on a seller's judgment.

What KT says about its overseas program

KT's overseas offer covered E7 and E9 visa holders coming to work in Korea, as well as D2 and D4 visa holders coming to study. For those categories, the advertised process accepted a single passport copy for advance registration. Brokers promoted the service and gathered passport images from people preparing to move.

KT says the Ministry of Science and ICT formally approved its overseas SIM service. The company also says it verifies foreign customers again once they receive their Residence Cards, the identity documents used by foreign residents.

Company officials say they cross check other documents, including employment contracts and university admission letters, to confirm applicants' identities. Those additional steps do not appear in KT's publicly posted service terms, leaving uncertainty about how consistently they are performed and whether they happen before a number becomes active.

Park Jae-sung, a legislative aide to Choi Hyung-du, argues that the basic requirements should be set in law rather than left to each operator:

The loophole should never be left to company policy but must be addressed by law.

KT's position rests on ministry approval, supporting document checks and later verification with a Residence Card. Choi's office is pressing for safeguards that apply uniformly from the beginning of the subscription process, including when an application starts outside Korea.

How other carriers check foreign customers

SK Telecom requires a Residence Card from foreign nationals seeking a postpaid line. It has separate procedures for diplomats, US military personnel and overseas Koreans, whose identity documents differ from those of other subscribers.

LG Uplus accepts passports but also requires supporting paperwork and verification in person. For E7 and E9 visa holders, the additional document is typically a standard employment contract. For D2 and D4 visa holders, it is usually an admission letter.

LG Uplus customers must appear before a staff member who checks them against their documents. The combination of supporting paperwork and a physical identity check gives the company more information to assess than a passport image alone.

KT's advance registration process offers greater convenience for eligible arrivals, but accepting a single passport copy introduces a weakness at the application stage. A person using stolen documents, or a broker handling them, can seek a number under an identity that appears legitimate.

The different requirements also shape newcomers' choices. Someone who has not yet received a Residence Card may be unable to obtain an ordinary postpaid line from SK Telecom, while the other carriers provide routes based on passports with different conditions attached.

How copied passports became a criminal business

Police identified 71 people connected to the operation involving more than 11,000 ghost SIM cards. These are SIMs registered under identities that conceal the people actually using them. At least nine suspects were arrested, including the owner of several phone shops in central Seoul.

Investigators say the group obtained passport scans through the encrypted messaging application Telegram and used them to activate SIMs at 18 retail stores across the country. Seven employees at two mobile virtual network operators were allegedly involved, approving applications based on photocopies and fabricated forms. A mobile virtual network operator, often called an MVNO, sells mobile service using another operator's network.

According to police, the SIMs supported voice phishing, drug transactions and illegal lending. Criminal users could make calls and send messages through numbers registered under foreign residents' names, making it harder for investigators to trace the actual operators.

Each SIM sold for between 200,000 and 800,000 won. Estimated profits reached about 1.6 billion won, and the suspected ringleader collected a commission of around 30,000 won per SIM.

The operation depended on more than stolen passport images. Retail outlets processed the applications, and employees allegedly approved registrations supported by false forms. That combination explains why stronger document checks must be accompanied by oversight of the people and businesses handling subscriptions.

What police seized and how much victims lost

Police seized more than 3,400 forged application documents and over 400 SIM cards during the investigation. They froze 730 million won in suspected criminal proceeds and requested the cancellation of 7,395 phone lines.

Authorities linked at least 1,400 of the ghost SIMs to voice phishing or large fraud cases. The requests to cancel thousands of lines show that the response extended beyond the physical cards recovered by investigators.

National Police Agency figures put nationwide voice phishing losses in 2024 at a record 854.5 billion won. Average losses per victim reached 41 million won that year. By July 2025, losses of about 800 billion won were already approaching the total recorded across all of 2024.

The projected figure of more than 1.37 trillion won for the end of 2025 was an expectation, with the year still underway on October 15. The increase in phones registered under foreign names, from 474 cases in 2019 to more than 71,000 in 2024, gives authorities another measure of the scale of the registration problem.

August measures and the push for common rules

The government introduced national measures in August 2025 requiring biometric checks for SIM registration. Biometrics use physical characteristics, such as a person's face, to help confirm identity. Carriers also now limit foreign passport holders to one line.

Authorities plan to hold telecom companies responsible for repeated illegal activations occurring under their supervision. The measures make identity checks a compliance obligation and put pressure on operators to monitor the registrations processed through their sales networks.

Choi wants uniform identity document requirements for all foreign subscribers, direct connections between telecom verification systems and immigration databases, better tools for detecting forged documents, and closer oversight of outlets registering large numbers of foreign customers.

His proposals would replace differing company practices with a common standard supported by law and automated checks. Linking registration to immigration records would also give carriers a way to check information beyond the documents handed over by an applicant.

The main dates show how the problem developed and when the response began:

• 2019: Police recorded 474 cases of burner phones registered under foreign names.
• 2024: The number exceeded 71,000, while nationwide voice phishing losses reached a record 854.5 billion won.
• July 2025: Voice phishing losses had reached about 800 billion won.
• August 2025: National measures introduced biometric checks for SIM registration, alongside a limit of one line for foreign passport holders.
• October 15, 2025: Scrutiny focused on overseas registration, differing carrier requirements and calls for stronger legal standards.
• End of 2025: Authorities expected voice phishing losses to exceed 1.37 trillion won.

Checking a live person and an authentic passport

Biometric verification can help connect an applicant to an identity document during remote registration. A facial scan can be compared with a high quality identity photograph, while a liveness check tests whether a real person is present instead of a photograph, recording or mask.

Many banks use this approach to verify customers through smartphones. For mobile registration, combining the facial comparison with liveness detection would make it harder to impersonate someone using a copied passport image.

Passport authentication can also go beyond looking at the photograph page. Modern passports contain a machine readable zone and a contactless chip. The machine readable zone presents identity information in a format a device can read automatically.

Reading the chip and checking its digital signature through public key infrastructure can confirm that the passport was issued by a genuine authority and that its protected information has not been altered. Public key infrastructure is a system of digital credentials used to check who issued electronic information and whether it remains intact.

For carriers accepting passports, requiring chip reads where available and flagging documents that fail integrity checks would add another layer of protection. These are proposed technical safeguards, alongside the biometric registration measures introduced in August.

A connection to immigration records would allow checks of visa type, validity dates and entry records. For applications submitted before travel, a proposed model would reserve a number but activate service only after the system confirms that the applicant has cleared immigration.

Expired visas, conflicting information or several applications using the same passport would then trigger manual review before activation. This approach would place the strongest checks before a number becomes available for use.

Why smaller operators and shops need oversight

Fraud rings often target smaller operators and retailers with weaker controls. The alleged involvement of seven employees at two MVNOs shows why checking the applicant alone is insufficient when the people approving registrations can help false applications pass.

A common, certified verification process for all MVNOs would give operators the same minimum requirements. Independent audits and consistent records of each check would help investigators and regulators examine how a suspicious subscription was approved.

Carriers could also assess patterns across applications. Unusually large numbers of registrations at one outlet, repeated use of the same address or groups of applications connected to a single broker could prompt further checks or a temporary hold.

This kind of risk scoring uses combinations of warning signs to identify applications needing closer inspection. It would work alongside document authentication, limits on the number of lines and penalties for repeated violations.

Oversight of sales outlets matters because registration happens through a chain of businesses and staff. A strong carrier policy needs consistent execution at the shop counter and in the systems that approve each account.

Keeping phone access open for genuine newcomers

Foreign workers and students need mobile service to settle into Korea. Employers expect a contact number, and universities use numbers for campus notices and payment alerts. Waiting for a Residence Card can create practical difficulties because the card may take time to be issued after arrival.

A proposed compromise is a limited plan available through advance registration. It could cap spending, exclude international transfers and impose tighter call and data limits. Full service would become available after verification in person or validation of a Residence Card through an official application programming interface, a connection that lets systems exchange information automatically.

A rule allowing one number per passport should apply from the first day, with automatic blocks when repeated applications appear. Where an employment contract or university letter supports the application, the issuing institution could confirm it, for example through a secure code checked against its own system.

Foreign residents also need clear information about the risks of sharing passport images. They should know how to check for phone lines opened in their names and how to report suspected misuse. Instructions in several languages could help people act sooner when their identity documents are abused.

These proposed safeguards seek to preserve the convenience of advance registration while reducing the opportunity to activate service using someone else's documents. Genuine applicants would retain a route to a working number, with fuller access following stronger verification.

Thailand's response offers a regional comparison

Thailand tightened SIM registration following a wave of telecom scams. Its regulator introduced liveness detection for all new prepaid and postpaid subscribers, as well as SIM replacements that retain an existing number.

Applicants must present original identity documents. Foreign subscribers use passports, while corporate accounts require company certificates and proof that the person signing has authority to act for the business.

The technology compares a live face with the identity document in real time. It is intended to block static photographs and deepfake attempts that previously fooled staff. Operators must also comply with data protection rules governing the storage and use of identity information.

Thailand's approach places the connection between a real person and a legitimate document at the moment of registration. For Korea, combining that type of check with official records, limits on the number of lines, monitoring of busy outlets and penalties for repeated violations would address several points where fraudulent applications can enter the system.

The balance is practical: newcomers need a phone, and authorities need confidence that the person receiving it is the person named in the application. The debate around KT's program concerns how to meet both needs before a number goes live.

What to Know

• KT offered eligible E7, E9, D2 and D4 visa holders overseas registration using a passport copy for a 5G postpaid plan costing 36,575 won a month, with service on arrival.
• KT says its program has ministry approval, includes supporting document checks and requires verification again after customers obtain Residence Cards.
• SK Telecom requires Residence Cards for ordinary foreign postpaid subscriptions; LG Uplus requires supporting documents and verification in person.
• Police recorded more than 71,000 burner phones under foreign names in 2024, compared with 474 cases in 2019.
• Investigators identified 71 people connected to more than 11,000 ghost SIMs, arrested at least nine suspects and requested cancellation of 7,395 lines.
• Voice phishing losses reached 854.5 billion won in 2024 and about 800 billion won by July 2025. Authorities expected losses above 1.37 trillion won by the end of 2025.
• August measures introduced biometric registration checks and a limit of one line for foreign passport holders. Authorities plan accountability for repeated illegal activations.
• Choi Hyung-du seeks uniform legal requirements, immigration database connections, stronger forgery detection and closer oversight of sales outlets.
• Proposed safeguards include live facial checks, passport chip authentication, limited advance plans and stronger controls for MVNOs while preserving access for genuine newcomers.