Skip to content
>_ITDITDWeb Security Platform

Security Guides

#identity verification#identity theft#data breach#phishing#Japan

Japan's online ID checks move to IC-chip reading (April 2027): what changes, and how users and businesses should prepare

From 1 April 2027, Japan abolishes in principle the online ID check where you upload photos of your driver's license (the "ho" method) for bank accounts and similar services. IC-chip reading and My Number Card certificates replace it. When it changes, why, which PINs you need, and what businesses should do.

Published 2026-10-12 Updated 2026-10-12 Last verified 2026-10-12 14 min read

Who this is for: people in Japan who go through online identity checks (eKYC) to open a bank account, sign a mobile contract or similar, including foreign residents with a residence card or Japanese driver's license, and people who run services that collect ID documents. It is based on official information from the National Police Agency (NPA), the Financial Services Agency (FSA), the Ministry of Internal Affairs and Communications (MIC) and the Digital Agency, all in Japanese. If your license image has already leaked, see what to do when your driver's license image or number leaks.

What changes, and when

Two areas in Japan set ID check methods by law: the Act on Prevention of Transfer of Criminal Proceeds, which covers bank accounts, credit cards and similar transactions, and mobile phone contracts. Both are moving away from images and copies of documents and toward IC-chip reading. Only the timing differs.

ProcedureNow (October 2026)After the change
Bank accounts and other covered transactions, onlineThe business chooses from sending photos of the document and your face, mailing copies, IC-chip reading, My Number Card certificates and othersFrom 1 April 2027, methods using document images or copies are abolished in principle. IC-chip reading and electronic certificates become the main methods
Bank accounts and other covered transactions, at a counterShow a photo ID documentFrom 1 April 2027, in principle, show the document and have its IC chip read
Mobile phone contracts, onlineSince 1 April 2026, IC-chip reading is required in principle (uploading document photos is already abolished in principle)—
Mobile phone contracts, in storeShow the documentFrom April 2027, IC-chip reading is required in principle
Procedures with no method set by law (sign-ups, age checks, car sharing and similar)Many services accept document imagesNo across-the-board legal change. Up to each business

The NPA's public leaflet says financial institutions may start before 1 April 2027 at their own discretion. The FSA has also asked them not to wait, so some banks may stop accepting images earlier.

The "ho" method is the common name for sending photos of your document and face

"Ho hoshiki" refers to Article 6(1)(i)(ho) of the current Ordinance. You use the business's app to photograph a photo ID document and your face and send the images. It is abolished on 1 April 2027, and mailing copies (item "ri") and similar methods also end in principle.

The amended Ordinance re-letters its items, so letters such as "ho" or "wa" before and after the change do not necessarily mean the same method. When reading a business's guidance, check what you are sending (an image, IC-chip data or an electronic certificate) rather than the letter.

Why images are not good enough

Once a document is photographed, the image is data separate from the document. It does not degrade when copied, and it can be sent any number of times by anyone. Telling it apart from an image of a forged document or someone else's document depends on things like the document's visible thickness and comparison with a face photo.

The NPA's Q&A says the amendment abolishes methods with a high risk of impersonation through forged or altered ID documents. An IC chip stores the name, address, date of birth, photo and other data, and the NPA's Q&A requires businesses to confirm that the data they read is genuine. Reading it needs the physical card in hand and the PIN.

Sending document images

  • What is sent: photos of the document and your face
  • What you need: a phone camera
  • Spotting forgeries: judged from how the image looks
  • If the image leaks: others can send the same image

Reading the IC chip

  • What is sent: the data stored on the chip
  • What you need: the physical card, its PIN and an NFC phone
  • Spotting forgeries: the stored data can be verified as genuine
  • If an image leaks: the image alone cannot be read as a chip
A document image can be sent by someone else after it leaks. IC-chip reading does not work without the physical card and its PIN.

In 2026, businesses that held ID document data kept reporting leaks, some including images. In the Times Car incident, the operator said document images such as driver's licenses leaked for about 1.6 million accounts (Times Car breach). In other cases images did not leak, but ID document types and numbers may have (Lashinbang).

In its 9 October 2026 notice, the FSA noted that customer data including images of ID documents such as driver's licenses had leaked. It asked financial institutions to check thoroughly for anything unnatural in document and face images during online checks, and to move to IC-chip reading as quickly as possible without waiting for the effective date.

This site's view: the way to limit leak damage is to stop collecting images

As long as some ID checks accept images, an image leaked from one company can be used to apply somewhere else. However much the leaking company apologizes, the image cannot be taken back.

With IC-chip reading, businesses hold fewer images, and even a leaked image is not enough to pass the next check. Users have to remember their PINs, but that extra step is the part that stops impersonation.

What you will be asked to do

In an IC-chip check you usually follow the business's app and hold your card against the back of your phone. Some services also ask you to photograph your face.

Documents and the PINs you need
Driver's license
The two four-digit PINs (PIN 1 and PIN 2) you set at issuance or renewal. The NPA leaflet says both are needed to have the chip read. Three wrong entries in a row make the chip unreadable
My Number Card (signature certificate)
A password of 6 to 16 letters and numbers. Five wrong entries in a row lock it (Digital Agency)
My Number Card (user authentication certificate)
A four-digit PIN. Three wrong entries in a row lock it (Digital Agency)
PINs used with the My Number Card
Depending on the method, one of the two above or another PIN. Follow the app's instructions
My Number Card on a smartphone
The card's functions stored on your phone. Available on iPhone since 24 June 2025 (Digital Agency). Services that support it can verify you without tapping the physical card

The electronic-certificate method (JPKI, the public personal authentication service) uses the card's certificate to sign electronically and prove who you are. A private business needs government accreditation to use it directly, or must use a service from an accredited provider (Digital Agency and MIC guidelines).

Prepare now

1

Check your two driver's license PINs

If you still have the PIN record you received at issuance, find it. If you have forgotten the PINs, take your license to a police station or driver's license center to look them up.

Tokyo's Metropolitan Police Department and Nagano Prefectural Police say they do not answer by phone, and Nagano says a proxy cannot look up or unlock the PINs for you. Places and hours differ by prefecture, so check your prefectural police website. According to the Tokyo police, the PIN cannot be changed until your next license is issued.

2

Check your My Number Card PINs

Check the signature certificate password (6 to 16 letters and numbers) and the user authentication PIN (four digits). If you forget or lock one, and you know the other, you can reserve through a dedicated app and reset it at a convenience-store kiosk (JPKI portal).

If you know neither, or your certificate has expired, take your card to the municipal office where you are registered.

3

Check whether your phone supports NFC

IC-chip reading needs a phone with NFC (the feature that communicates with nearby IC cards). Check the supported-device list in the app of the service you plan to use. If your phone lacks NFC, see whether the service offers an in-person route or a card reader option.

4

Check the options if you have no IC-chip document

MIC says that for mobile contracts, not having an IC-chip document does not mean you cannot sign up, and that documents such as a certified copy of your residence record can be used. Under the Act on Prevention of Transfer of Criminal Proceeds, a method of mailing the original of certain anti-forgery documents remains for people without IC-chip documents (NPA Q&A).

A passport may not work for online checks

Japanese passports issued on or after 4 February 2020 have no address field, and their IC chips hold no address. The NPA's Q&A says such passports cannot be used for online methods based on IC-chip data, even with another document showing your address. Use a driver's license, My Number Card or residence card instead.

Scams that use this change

When rules change, phishing messages claiming "the ID check method has changed, so you must act" become more common. A message that claims to be from a bank or a company that leaked your data is not proven genuine just because it has your name or real transaction details (what is phishing).

Signs of a genuine process

  • It happens entirely inside an official app or website that you opened yourself
  • You type your PIN on your own phone screen
  • The law does not require across-the-board re-verification of accounts opened before the change (NPA Q&A)

Messages you should not act on

  • A link in an email or text leading to a "re-verification" page
  • Someone asking for your PIN or password by phone, email or chat
  • A request to send photos of both sides of your card, or the card itself

If you tell someone the PIN used for IC-chip reading, that person can read the chip once they get hold of the card. Do not give it to anyone who asks.

What businesses should do

Any service that collects ID document images faces a bigger impact when it leaks, whether or not it is covered by the Act on Prevention of Transfer of Criminal Proceeds. Given the run of leaks in autumn 2026, we see little reason to wait for the deadline.

1

Bring forward the move to IC-chip reading or electronic certificates

Businesses covered by the Act cannot use image-based methods in principle from 1 April 2027, and the FSA has asked financial institutions to move without waiting. Services outside the Act, such as car sharing or membership services, still find it hard to stop sign-ups with leaked images as long as they accept images.

2

Keep images only as long as required, and delete the rest

Businesses covered by the Act must keep verification records for seven years from the day the contract ends (NPA overview of the Act). Images that no law requires you to keep should be deleted without delay once you no longer need them, as Article 22 of the Act on the Protection of Personal Information asks businesses to try to do. Check whether images of people who left or never finished signing up are still stored.

3

Separate stored images from day-to-day systems

Document images are not needed for routine member management or order processing. Keep them in separate storage with separate permissions, require multi-factor authentication for admin sign-ins, and log who viewed them and when. For how to run the checks, see Japan's October 2026 unauthorized-access warnings: checks to run this week.

4

Tell users first

Before switching, publish on your official site how to check PINs, the alternatives for phones without NFC and people without IC-chip documents, and the fact that you never ask for PINs by email or text. This makes copycat phishing easier to spot.

Sources (public information, in Japanese)

The rules and dates in this article were checked against the following official sources on 12 October 2026.

FAQ

QWhy is Japan ending ID checks based on photos of your license?
A

Images of documents are hard to tell apart from images of forged or someone else's documents, so they are easy to use for impersonation. The National Police Agency's Q&A describes the amendment as abolishing methods with a high risk of impersonation through forged or altered ID documents. On 9 October 2026 the Financial Services Agency citing the current situation of repeated unauthorized access and leaks of customer data that included driver's license images, called IC-chip reading extremely effective against fraud.

QWhen does it change?
A

For bank accounts and other transactions covered by the Act on Prevention of Transfer of Criminal Proceeds, on 1 April 2027 (the ordinance amendment promulgated on 24 June 2025). Financial institutions may start earlier at their own discretion. For mobile phone contracts, IC-chip reading has been required in principle for online contracts since 1 April 2026, and in-store contracts follow from April 2027.

QWhat is the "ho" method (ho hoshiki)?
A

It is the common name for the method in Article 6(1)(i)(ho) of the current Ordinance: the customer uses the business's app to photograph a photo ID document and their own face and sends the images. It is abolished when the amendment takes effect on 1 April 2027. The amended Ordinance re-letters its items, so the same letter may not refer to the same method before and after the change.

QWhich PINs do I need to read my driver's license IC chip?
A

The two four-digit PINs (PIN 1 and PIN 2) you chose when the license was issued or renewed. The National Police Agency's leaflet says both are needed to have the chip read. Three wrong entries in a row make the chip unreadable. If you forget them or the chip is locked, take your license to a police station or driver's license center to look them up or unlock it. Some police forces, such as Tokyo's and Nagano's, do not handle this by phone or through a proxy, so check your prefecture's police website for places and hours.

QWhat if my phone has no NFC, or I have no ID with an IC chip?
A

You are not shut out. The Ministry of Internal Affairs and Communications says that for mobile contracts, people without an IC-chip document can still use documents such as a certified copy of their residence record. The Act on Prevention of Transfer of Criminal Proceeds also keeps a method where you mail the original of certain documents with anti-forgery features, for people without IC-chip documents. Some services offer an in-person route. Which options are available varies by business, so check each service's guidance.

QI got an email saying I must redo my identity verification. Should I?
A

Do not use the link in the email or text. The National Police Agency's Q&A says that accounts opened with a method that is being abolished do not have to be re-verified by another method after the change takes effect. A bank may still ask on its own judgment, but even then, open the official app or website yourself. You never need to tell anyone your PIN by phone or email, or send photos of your card.