The scratch-off card is a poor man's one-time password generator. In fact, it's remarkably effective at preventing scammers from draining people's accounts, as

The scratch-off card is a poor man's one-time password generator. In fact, it's remarkably effective at preventing scammers from draining people's accounts, as long as you're not stupid enough to take a photo of your card and post it online (yeah, people do that). That little card is what prevents the whole ActiveX fiasco from crumbling down like a house of cards, precisely because it's so low-tech (i.e. requires physical access). A lot of the other crap is understandable when you take into account the fact that online banking was first introduced to Korea in the mid-1990s. HTTPS was useless at the time because of U.S. export restrictions limiting it to 40 bits. Home-brewed ActiveX controls were used to implement 128-bit encryption. Korea also decided to use public keys and X.509 client certificates to identify people, way ahead of the rest of the world, but of course no browser supported them so someone had to write custom software. After that, inertia and regulatory capture allowed what was supposed to be a stopgap measure to continue for another 15+ years, long after proper HTTPS became available in every browser. The only benefit I can think of is that Koreans don't have to worry about those stupid password restrictions that a lot of American banks impose on their customers :)