Is a photo of your driver's licence still safe proof of identity? In Japan, regulators have decided it is not. The Financial Services Agency is pushing banks and crypto exchanges to stop relying on the photos of ID cards that customers upload when opening accounts online and to read the chip inside the card instead, after a hack at car sharing service Times Car exposed about 1.6 million identity document records, according to Martin Cid Magazine.
The request comes as Japan's government describes the country as facing an emergency in cyberspace, with a string of breaches at railway, retail and restaurant companies leaking names, addresses and birthdates by the million. The lesson reaches well beyond Japan: anyone who has photographed a licence or passport for an app is exposed in the same way, and unlike a password, those details cannot be changed.
What the regulator is asking banks to do
The FSA's request, issued on 9 October, asks banks and crypto exchanges to move ahead of a rule change already scheduled. From 1 April 2027, Japan's identity verification framework is set to end checks based on uploaded images of documents and make reading the IC chip the standard method for online account opening.
Financial services minister Satsuki Katayama said institutions should "properly implement identity verification processes, including reading integrated circuit chip data." For now, the message is a push rather than an order, but it signals that regulators see photo based checks as no longer reliable when millions of document images may be circulating among criminals.
Online account opening in Japan has relied heavily on a method in which customers upload a photo of an ID document along with a selfie. That approach made it easy to open accounts from a smartphone, but it assumes the person holding the document is its rightful owner. Once millions of document images are in criminal hands, that assumption breaks down.
The Times Car breach
Times Car, operated by parking company Park24, said intruders reached about 6.6 million current and former member accounts. Around 1.6 million of those records included identity documents such as driver's licence images. Names, addresses, birthdates, phone numbers and licence details are among the fields that may have been exposed.
The company first detected the intrusion on 25 September. Data on people who had already left the service had been kept for about seven years, a detail that Japan's Personal Information Protection Commission highlighted when it told companies to delete data they no longer need.
A password can be changed in a minute. A face, a name and a birthdate cannot. Every ID photo uploaded to an app is a permanent liability once it leaks.
Several of the breach counts are still preliminary and may change as companies complete their investigations. No group has claimed the attacks, and investigators have not tied them to a single culprit.
Car sharing services typically require a driver's licence check before allowing members to rent vehicles, which is why Times Car held so many licence images. The breach shows how routine identity checks across many industries create large stores of sensitive documents that become attractive targets for attackers.
A wave of breaches across Japan
Times Car is one name on a long list. The restaurant chain Yakiniku King said more than 10 million customer records were copied from its reservation and rewards app. JR East, Japan's largest rail operator, lost about 1.67 million email addresses from its Eki-net booking system, and Tokyo Metro, convenience store chain Lawson and the Nikkei newspaper have also disclosed incidents.
Digital Minister Masaaki Taira called a crisis meeting and described an "emergency in cyberspace," while cybersecurity minister Toshiharu Furukawa called the situation "extremely critical." The industry ministry is asking about 1,000 industry groups to check their systems for weaknesses. Japan's banks have also faced disruption, as we covered in our report on the PHP2Shell flaw that took bank websites offline.
The scale of the incidents has shaken confidence in how Japanese companies handle personal data. Many of the affected firms are household names used by millions of people daily, from train bookings to restaurant reservations. Japan logged more cybersecurity incidents in the first nine months of this year than in all of last year, according to figures shared with Reuters.
How attackers are getting in
Japan's computer emergency response team, JPCERT/CC, has described the techniques it is seeing: scanning for unpatched flaws, abusing internal interfaces discovered by taking apart companies' mobile apps, and exploiting a known SQL injection bug in the Metabase analytics tool. Security specialists have described the pattern as a broad sweep across many targets rather than carefully chosen attacks.
Some experts suspect that AI tools are making such campaigns cheaper by reducing the time needed for reconnaissance, which makes smaller companies worth targeting, although the attacks have not been explicitly linked to AI. The key weaknesses exposed by the breaches include:
- Unpatched software and known vulnerabilities left open
- Internal app interfaces that attackers can reverse engineer
- Storing identity documents longer than necessary
- Relying on photos of documents that can be copied and reused
- Slow detection of intrusions across large customer databases
Crypto platforms across Asia have faced similar pressure from attackers exploiting software flaws, as we covered in our report on the Initia blockchain exploit. The common thread is that known weaknesses, left unpatched, give attackers an easy way in, regardless of whether the target is a car sharing service, a restaurant chain or a financial platform.
What it means for banks, crypto platforms and customers
Chip reading is a real improvement. Data stored on an IC chip is far harder to fake than a photo, because it is digitally signed by the issuing authority. But it does nothing about data that has already leaked. Names, addresses and birthdates remain useful for phishing calls and fraudulent loan applications for years.
The chip method also requires a phone with NFC and a card that carries a chip, which may exclude some customers. For banks and crypto exchanges across Asia, Japan's move is a signal: regulators may soon treat uploaded ID photos as weak evidence everywhere. Firms that still rely on them should expect pressure to upgrade, and customers should be cautious about which apps they share document images with.
Other countries in Asia have already moved in a similar direction. Several Southeast Asian regulators encourage or require digital identity checks linked to national ID systems, and banks increasingly use liveness detection to confirm that a real person is present. Japan's April 2027 deadline could add momentum to that shift across the region.
Why is Japan telling banks to stop using ID photos?
After a hack exposed about 1.6 million identity document records, regulators consider uploaded ID photos unreliable proof of identity.
What does the FSA want banks to do instead?
It wants banks and crypto exchanges to read the IC chip in identity cards rather than relying on uploaded photos.
When does the new rule take effect?
From 1 April 2027, Japan's framework is set to end image based checks and make chip reading the standard method.
How big was the Times Car breach?
Intruders reached about 6.6 million member accounts, around 1.6 million of which included identity documents.
Who operates Times Car?
Times Car is operated by the parking company Park24.
What other Japanese companies were hacked?
Yakiniku King, JR East's Eki-net, Tokyo Metro, Lawson and the Nikkei newspaper have disclosed incidents.
How many records did Yakiniku King lose?
The restaurant chain said more than 10 million customer records were copied.
What did Japan's ministers say?
Digital Minister Masaaki Taira described an emergency in cyberspace, and Toshiharu Furukawa called the situation extremely critical.
How are attackers getting in?
JPCERT/CC cited unpatched flaws, abuse of internal app interfaces and a known SQL injection bug in Metabase.
Is chip reading safer than photos?
Yes. Chip data is digitally signed and much harder to fake, though it does not protect data that has already leaked.
What are the limits of chip reading?
It requires an NFC capable phone and a chip based card, and it cannot undo past leaks.
Who is behind the attacks?
No group has claimed the attacks, and investigators have not tied them to a single culprit.
Why was data retention criticised?
Times Car kept former members' data for about seven years, and regulators told companies to delete data they no longer need.
When was the Times Car intrusion detected?
Times Car first detected the intrusion on 25 September 2026.
What should customers do?
Be cautious about sharing ID document images with apps and watch for phishing and fraudulent loan attempts.
Japan's push to replace ID photos with chip reading is a direct response to breaches that have made document images close to worthless as proof of identity. The April 2027 rule change will reshape online account opening for banks and crypto exchanges. For the rest of Asia, the message is clear: once an ID photo leaks, it never stops being a risk.
Talk to the SpinDepth deskYou've finished this story
Read on, send it to someone, or ask about it.
