ID Verification: Korea's QR Scan Shares Just 3 Facts

Someone can fake your digital I.D. right now, and if the person checking it just glances at the screen, they'll never know. Forgers have built apps that copy the look of a mobile I.D. perfectly. The screen looks real because it was designed to look real.

If you've ever flashed your phone to prove who you

If you've ever flashed your phone to prove who you are, at a store, a bank, a government office, this is your world now. South Korea just launched a national campaign to fix exactly this problem. Their three biggest phone companies teamed up with law enforcement because fake mobile I.D.s were spreading fast. And the fix they landed on teaches us something surprising about how digital identity actually works. So how do you prove a phone screen is real when a screenshot looks identical?

Let's start with why the old way broke. For years, checking an I.D. meant a person looked at it with their own eyes. That worked with paper, hard to fake a hologram on the spot. But a phone screen? A forger can composite an image or build an app that mimics the real display down to the pixel. Your eyes can't catch it. This article is part of a series, start with Biometric Entry One Setting Flags 42 Of Real Fans.

So Korea's system, it's called PASS, stopped relying on your eyes. It stacks five separate checks instead. First, it confirms your phone subscription is real. Second, it verifies you actually own that device. Third, it blocks screenshots entirely. Fourth, it shows moving images, not a frozen picture. And fifth, each verification expires after a set time.

Why does moving matter so much? Because a screenshot can only capture a still frame. A fake can copy one moment, it can't copy motion that keeps changing. That single design choice defeats the most common forgery.

The heart of this is the Q

Now, the heart of this is the Q.R. QR code, and here's what most people get wrong about it. People assume a Q.R. code is secure because it looks like scrambled encrypted data. It isn't. A Q.R. code is just a container. It holds no security of its own. Previously in this series: Id Verification Koreas Qr Scan Shares Just 3 Facts.

The article uses a great comparison. A Q.R. code is like a postal address, not a mailbox. The address just points somewhere. What matters is what happens when you arrive. Does a clerk check one fact and stamp your visitor badge? Or do they hand you a key to every drawer in the building? That's the difference between a safe system and a risky one, and it's invisible in the code itself.

This is where two kinds of Q.R. codes split apart. A dynamic code refreshes constantly, a new identifier every sixty to a hundred and eighty seconds, then it dies. A static code never changes and can stay valid for hours, or forever. The static one becomes a reusable pass anyone could grab. The dynamic one is a one-time ticket. For the rest of us, that means a screenshot of a real PASS I.D. is worthless, the code inside already expired.

And when it works right, PASS shares almost nothing. Just three facts, your name, your date of birth, and your gender. That's it. This isn't a small experiment, either. It runs in over thirty-six hundred community centers across Korea, with more than ten million subscribers using it for real. Up next: Biometric Entry One Setting Flags 42 Of Real Fans Podcast.