Privacy concerns mount as Korean telecoms adopt facial recognition for new lines

The planned use of facial recognition to open new mobile lines is raising privacy concerns in Korea. 

Starting Monday, the country's three major carriers and budget operators will require facial recognition, or one of several alternative identity checks, before activating a line. The measure is meant to shut down phones opened under stolen identities and used in voice-phishing scams, but the collection of biometric data is already drawing objections.

The Ministry of Science and ICT announced the plan as part of a broader package against phone fraud on Tuesday. Until now, a sales clerk has verified a buyer's ID card and visually compared it with the customer's face. Under the new system, the clerk photographs the buyer on the spot and matches the image against the ID photo before the line can be opened.

The change targets burner phones — lines opened under other people's identities. The National Police Agency recorded 20,000 such phones last year, when voice-phishing losses reached 1.3 trillion won ($840 million). The government ran a facial recognition trial from last December and will roll the technology out on Monday across every in-person and online channel at the three carriers — SK Telecom, KT and LG U+ — and budget operators.

The Ministry added fallback options after concerns grew during the trial period over the handling of sensitive information. Smartphone users can verify themselves through the mobile ID app run by the Ministry of the Interior and Safety, while those without a smartphone can use a resident registration abstract issued the same day.

The enforcement decree of the Telecommunications Business Act is also being revised to allow facial information to be used for user identification. As of now, there are no provisions for using facial data to verify identity. 

"Korea relies on phones for banking and authentication more than most countries, so crimes like burner phones are common too, and stronger identity verification is unavoidable," the ministry said.

Even with the alternatives, the possibilities of data leaks loom. 

When China introduced facial authentication for phone activation in 2019, the facial data it collected was later traded on online platforms, sparking a backlash.

"Facial data is encrypted, held for 0.04 seconds and then immediately destroyed," said Choi Woo-hyuk, who heads information security and network policy at the Ministry of Science and ICT. A preliminary check by the Korea Internet & Security Agency (KISA) found no vulnerabilities related to data leaks, the government said.

The telecom industry has also expressed concern that low facial-recognition accuracy could add to customer inconvenience.

"Recognition rates have risen to a level close to the financial sector, which adopted facial authentication first," Choi said. "That said, there are variables like old ID cards or changes in a person's face, so it may not be recognized 100 percent of the time."

The government is also moving to suspend operations at three budget carriers caught in fraudulent activations, which includes a halt on signing up new subscribers, and to cancel the registration of one internet phone provider that misrepresented its numbers. It is pushing a "one-strike-out" rule that would let it penalize complicit carriers and retailers immediately, without first issuing a corrective order.

The package also targets so-called "self-rescue phones," a scheme in which people in debt are lured with loans or high-paying part-time work into opening lines in their names that are then handed to criminals. Carriers will have to warn customers of the illegality when activating a line, and installment purchases of expensive handsets by high-risk buyers will be restricted.

BY KIM MIN-JEONG [[email protected]]