Security Guides
If your Japanese driver's license data was leaked: what to do to prevent misuse (credit bureau alerts, reissue, where to get help)
What to do when a company leaks your Japanese driver's license image or number: credit bureau alerts, credit file checks, what a reissue changes, who to call.
Who this is for: people who were told that their Japanese driver's license image or number, or other ID document numbers, were (or may have been) leaked, for example in the Times Car, Cariteco or Lashinbang incidents. It is written with foreign residents who hold a Japanese license in mind, and it is based on official information from the National Police Agency, the Ministry of Internal Affairs and Communications, the credit bureaus and other bodies. It does not describe how misuse works.
First: what exactly leaked?
"My license data leaked" covers very different situations. Whether an image of the card was included makes the biggest difference. Check the company's notice to see which items apply to you.
In the Times Car incident, for example, the operator says data on about 6.6 million accounts (name, address, date of birth, phone number, email address, driver's license details and more) was obtained, and about 1.6 million of those accounts included images of driver's licenses or other ID documents. People without an image in the leak still had their license details (such as the number) exposed.
| What leaked | Where it could be misused | What it cannot do on its own |
|---|---|---|
| Image of the license (front and back) | Sign-ups or applications with services that accept an ID photo as proof of identity | Pass an IC-chip check, which needs the physical card and its PIN |
| License number and other text, no image | Making scam contact look genuine; filling in application forms | Pass checks that need a document image, the IC chip or the original document |
| Name, address, date of birth, phone, email | Emails, texts and calls posing as the company or a public body | Open a bank account or take out a loan by themselves |
The non-face-to-face identity checks that the Act on Prevention of Transfer of Criminal Proceeds requires for bank accounts and credit cards combine methods such as a document image, an IC-chip read, or sending the original or a copy. None of them works with text details such as a number alone. When no image leaked, the main risk shifts to convincing scam contact.
Uploading a document image
A leaked image may work. Abolished in principle for mobile phone online contracts in April 2026; for bank accounts and similar, scheduled for April 2027
Showing the original at a counter
An image alone rarely works, but a forged card is still a risk
Reading the IC chip
Needs the physical card and PIN. A leaked image or number is not enough
Image-based ID checks are being phased out, but not yet everywhere
According to the Ministry of Internal Affairs and Communications, mobile phone contracts made online have required reading the ID document's IC chip, in principle, since April 1, 2026, and uploading a photo of the document is no longer accepted. In-store contracts change from April 2027.
For bank accounts and other transactions under the Act on Prevention of Transfer of Criminal Proceeds, the National Police Agency promulgated an amendment in June 2025 that abolishes, in principle, sending a document image or a copy for non-face-to-face checks. It is scheduled to take effect in April 2027.
Meanwhile, sign-ups, age checks and sharing services where no law sets the verification method may still accept a photo of your license. That is why a leaked image is worth watching for years, not weeks.
What to do today
Do not follow links or instructions in messages claiming to be the company
After a leak, scam messages posing as the company may follow, such as "refund procedure for the incident" or "please resubmit your license to confirm your identity". With your name, phone number and email exposed, these can look genuine.
Do not use links or phone numbers in the message. Open the official website or app yourself instead. If asked to resend a photo of your license, do not do it on the spot (see What is phishing).
Register an identity-fraud alert with all three credit bureaus
Honnin shinkoku is an alert you report yourself to a credit bureau when your ID may be misused after loss, theft or a leak. Lenders and card companies that check your file see it and can review applications more carefully.
Each bureau has different member companies, so registering with all three gives the widest coverage. Fees are in the table below; online, the total is about 2,200 yen. The bureaus' procedures are in Japanese. JICC accepts a residence card as one of its ID documents.
Save the company's notice and note what leaked
Keep the notification email or a copy of the official notice, and note what leaked (an image or only the number) and the company's contact point. If an unfamiliar contract appears later, this helps you explain the situation to the police and the company involved.
| Bureau | Alert (online) | Alert (by post) | Period | Notes |
|---|---|---|---|---|
| CIC | 1,000 yen | 1,000 yen (postal money order) | 5 years from registration | Online requires a reception number obtained by calling from the phone number registered with CIC through your card companies |
| JICC | 700 yen (smartphone app) | 1,111 yen (voucher bought at a convenience store) | 5 years from registration | The app still asks for photos of two ID documents |
| KSC | 500 yen | 2,403 yen (voucher bought at a convenience store) | Up to 5 years | Online requires a My Number Card. Not checked when you open a deposit account |
(Fees checked on each bureau's official site on October 3, 2026. They can change, so check the source pages before applying.)
The alert does not block applications
CIC says credit decisions are made by its members and that it does not guarantee the alert's effect. KSC likewise states that the alert does not bind its members' decisions and does not guarantee that misuse will be prevented.
In other words, the alert prompts reviewers to take care. It makes an application with your leaked data less likely to slip through, which is why it should be paired with the next step: checking your file to see whether anything was actually opened. This is closer to a "fraud alert" than to a US-style credit freeze.
What to do this week
Request your credit file and look for applications you did not make
Your credit file shows not only credit and loan contracts but also inquiries that member companies made when someone applied (application records). At CIC these stay for six months from the inquiry date.
Application records show the name of the company that made the inquiry, so look for companies you never applied to. Check once right after the leak and again a few months later, so the two checks cover more than one six-month window. Online fees: CIC 500 yen, JICC 700 yen (smartphone app), KSC 800 yen. By post: CIC 1,500 yen, JICC 2,177 yen, KSC 2,403 yen.
Watch for unexpected mobile phone contract messages
When a smartphone is bought on an installment plan, the mobile carrier checks CIC (per CIC's FAQ). An application in your name that includes an installment purchase may therefore show up in your CIC application records. SIM-only contracts and other contracts without a credit check do not appear there.
As far as this site could confirm, carriers do not publish a common service that lets anyone list all lines registered in their name. If you receive a contract confirmation, bill or text you do not recognize, contact that carrier through the number on its official website.
If you no longer use the service, ask for your data to be deleted
Japan's Act on the Protection of Personal Information lets you request suspension of use or deletion when a reportable leak has occurred or the company no longer needs the data (Article 35(5)). Former members and people who will not use the service again can ask the company's contact point to delete their data, including the license image.
You can also request disclosure of what the company holds (Article 33). Some records may have to be kept by law, but getting an answer about what remains and when it will be deleted is useful in itself. If you get stuck, the Personal Information Protection Commission runs a consultation line (03-6457-9849, in Japanese).
Does reissuing the license help?
Many people assume a new card makes the leaked data useless. Less changes than you might expect.
Article 94(2) of the Road Traffic Act allows a reissue when the license is lost, destroyed, soiled or damaged, among other cases. Article 21 of the Act's enforcement regulations adds cases such as wanting to change the photo, or when the public safety commission considers it appropriate. This site could not find a police page that addresses reissue because of a data leak. Ask the license center for your registered address whether it applies and how it would be handled.
What a reissue can change
- The photo on the card (changing the photo is a recognized reason for reissue)
- The 12th digit, the reissue mark (only for reissue after loss or destruction)
- The physical card itself
What a reissue does not change
- The first 11 digits of the license number (National Police Agency directive)
- Your name, date of birth and address
- What is shown in the image that already leaked
According to a National Police Agency directive dated March 10, 2025, a license number has 12 digits: a public safety commission code, the year of issue, a serial number, a check digit, and a reissue mark. The first 11 digits stay the same on reissue, and the reissue mark goes up only when the reissue is because the license was lost or destroyed.
The same directive covers the My Number Card driver's license (license data recorded on the My Number Card), which started on March 24, 2025. Its license record number shares the first 11 digits with the plastic license number. Switching does not cancel an image or number that has already leaked.
A reissue costs a fee (2,600 yen according to Osaka Prefectural Police) and a weekday trip to a license center or designated office. Right after a leak, the credit bureau alert and credit file check come first. If the leaked face photo bothers you, a reissue is a way to change the photo.
If you find a contract or bill you do not recognize
- Unknown card, loan or mobile contract or bill
- The company that holds the contract, via the number on its official website (not the one in the bill or message). Your credit report also lists the company's name and contact details
- Your name was used / you want to file a police report
- Your local police station. For non-emergency advice, call the police consultation line #9110 (nationwide; connects to the police HQ for the area you call from)
- Suspicious bills, sales pitches or contract disputes
- Consumer Hotline 188 (connects to a nearby consumer affairs center; advice is free, call charges apply)
- Problems with the leaking company's response or your requests
- Personal Information Protection Commission consultation line, 03-6457-9849 (weekdays 9:30 to 17:30)
- The company that leaked your data
- The dedicated contact point it announced. Get the number from its official website, not from a message you received
When you contact the company, say that you were notified of a leak and that you did not apply. Ask them to stop the contract and explain how the record registered with the credit bureau will be handled. Keep a note of any police consultation or report number, as the company may ask for it.
The lending self-restraint system was not designed for data leaks
The Japan Financial Services Association (the money-lending industry body) and KSC run a "lending self-restraint" system (kashitsuke jishuku). It lets people register themselves as someone who should not be lent to, for reasons such as a spending habit or gambling addiction. The record is shared with JICC, CIC and KSC; registration is free and lasts up to five years.
However, it cannot be withdrawn for three months, and while it is active it affects your own new borrowing and credit too; the association notes that cards you use may stop working. The tool meant for possible misuse of your name is the identity-fraud alert above. Use that first, and consider self-restraint only if you understand its effects.
What you do not need to do, or what does little
Ignore offers to 'delete your leaked personal data'
Japan's National Consumer Affairs Center has warned about calls in its name saying "your personal information has leaked, so we will delete it for you", and states that it never makes such calls. People who keep talking may be asked for money on various pretexts.
There is no paid way to pull data back once it is out. Do not respond, whether the caller claims to be a public body or a private company.
- Rushing to reissue your license: the first 11 digits of the number, your name and date of birth stay the same. Do the credit bureau alert and file check first.
- Assuming a password change fixes a license leak: changing a password protects your login to that service. It does nothing for leaked license data (though if you reused that password elsewhere, stop reusing it).
- Resending your license photo "for confirmation": if you are asked to resubmit your license after a leak, check in the official app or website whether it is really needed before sending anything.
Going forward: hand over fewer license images
Separate from responding to this leak, you can make future leaks less damaging.
Prefer IC-chip reading or the My Number Card when you can choose
When a service offers a choice, pick IC-chip reading or the My Number Card's public certification (proving who you are with the card's electronic certificate) instead of uploading a photo. These methods may let you avoid handing over a license image, or reduce what you hand over.
Close accounts you no longer use and ask for deletion
Closing an account does not always delete ID document images. When you leave a service, ask whether ID images will be deleted, and request deletion if needed.
When you must send an image, send only what is asked
Do not photograph the back or items you are allowed to hide if the service does not need them. Some organizations, such as JICC, tell you to cover the My Number (individual number) and QR codes when photographing documents.
Checklist
| When | What to do | Rough cost |
|---|---|---|
| Today | Do not open links in messages claiming to be the company. Check on the official site whether you are affected | Free |
| Today | Register the identity-fraud alert with CIC, JICC and KSC | About 2,200 yen in total (online) |
| This week | Request your credit file from all three bureaus and look for unknown companies in the application records | About 2,000 yen in total (online) |
| This week | If you no longer use the service, request deletion of your data, including the license image | Free |
| In 3–6 months | Request your credit file again | Same as above |
| Over the next year | Watch for unfamiliar bills, collection notices or contract confirmations. If one arrives, contact the company and the police (#9110) | — |
| Over the next year | When you can choose, use IC-chip reading or the My Number Card for identity checks | — |
| In 5 years | The alert expires. Register again if needed | About 500–1,000 yen per bureau |
Sources (public record)
The systems, fees and periods in this article were checked against the following official sources on October 3, 2026. Most are in Japanese.
- Identity-fraud alert: CIC: Honnin shinkoku / CIC: online / CIC: by post
- Identity-fraud alert: JICC: Honnin shinkoku comment / JICC: smartphone / JICC: by post
- Identity-fraud alert: KSC: Honnin shinkoku / KSC: FAQ / KSC: fee revision from April 1, 2026
- Credit file disclosure: CIC: disclosure / CIC: information held / CIC FAQ: mobile phone installments / JICC: disclosure / JICC: by post / KSC: disclosure
- Lending self-restraint: Japan Financial Services Association / KSC
- Amendment to the enforcement regulations of the Act on Prevention of Transfer of Criminal Proceeds (promulgated June 24, 2025): National Police Agency JAFIC
- Mobile phone identity check rules: Ministry of Internal Affairs and Communications
- License number format and reissue mark: National Police Agency directive (March 10, 2025)
- Road Traffic Act Article 94 — e-Gov / Enforcement Regulations Article 21 — e-Gov
- Reissue procedure and fee: Osaka Prefectural Police / Saitama Prefectural Police / My Number Card license: Tokyo Metropolitan Police Department
- Act on the Protection of Personal Information, Articles 33 and 35 — e-Gov / Personal Information Protection Commission consultation line
- Help lines: National Police Agency (#9110) / Consumer Affairs Agency: Consumer Hotline (188) / National Consumer Affairs Center warning
- Times Car incident: Times Mobility, second notice (September 28, 2026) / third notice (September 29, 2026)
Read next
- Incident details: Times Car breach (about 1.6 million license images) / Cariteco (Meitetsu Kyosho, driver's license data) / Lashinbang (ID document numbers and bank details)
- Scam messages after a leak: What is phishing
- Stop reusing passwords: How to choose a password manager
- Other 2026 incidents: Data breaches and cyberattacks in 2026
FAQ
QWhat can a leaked image of my driver's license be used for?
It can be used to register or apply in your name with services that accept a photo of an ID document as proof of identity. For bank accounts and mobile phone contracts, the image-upload method is being abolished: mobile phone online contracts have required reading the card's IC chip, in principle, since April 1, 2026, and transactions covered by the Act on Prevention of Transfer of Criminal Proceeds follow from April 2027 as scheduled. Until then, and for sign-ups or age checks where no law sets the method, an image can still be accepted.
QOnly my license number leaked, not the image. Do I need to do anything?
The risk is lower than with an image, but combined with your name, address and date of birth the number can make a scam call or an application look more convincing. Registering a credit bureau alert and checking your credit file are still worth doing; each costs a few hundred to about 1,000 yen per bureau.
QWhat is 'honnin shinkoku' and how much does it cost?
It is a self-reported alert that a Japanese credit bureau adds to your file when your ID may be misused after loss, theft or a leak. Lenders and card companies that check your file during a credit review see it and can review more carefully. Online fees (checked October 2026): CIC 1,000 yen, JICC 700 yen via its smartphone app, KSC 500 yen. It lasts five years at CIC and JICC, and up to five years at KSC. It does not block applications.
QWill reissuing my driver's license make the leaked data useless?
No. Under a National Police Agency directive, a reissued license keeps the first 11 digits of its number; the 12th digit (the reissue mark) goes up only when the license is reissued because it was lost or destroyed. Your name, date of birth and address do not change. The Road Traffic Act enforcement regulations do allow a reissue to change the photo; ask the license center for your address about how a leak is handled.
QDoes switching to the My Number Card driver's license help?
It does not cancel an image or number that has already leaked. Under the same directive, the license record number on a My Number Card shares its first 11 digits with the plastic license number. It helps in a different way: more services will let you verify your identity by reading the IC chip instead of sending an image.
QSomeone offered to delete my leaked personal data for a fee. Is that real?
Do not respond. Japan's National Consumer Affairs Center has warned about calls in its name offering to 'delete your leaked personal information' and states that it never makes such calls. There is no paid way to pull data back once it is out, and these conversations tend to end in demands for money.