Japan's FSA pushes banks from driving licences toward chip IDs after 20-plus corporate cyber incidents

The report's only price is for driving licence images, the document the FSA wants banks to move away from. According to the FT report as summarised by Mint, images like the Times Car licence photos could sell on dark web marketplaces for as little as 25 yen (around $0.15) apiece ^[13]. None have been sold yet ^[13]. At that floor, a thousand images would cost 25,000 yen, or about $150 ^[9]. We think regulators prefer chips because a photograph of a card is a file that can be copied and resold. It does not contain the chip that a passport or MyNumber card carries ^[1]. (That is our inference about why regulators prefer chips.)

The chip protects the account-opening step and leaves storage alone. JR East believes about 1.67 million customer email addresses may have been stolen through its booking system ^[3]. Even if a chip reduces the verification risk, experts quoted in the FT report say organisations still need to update vulnerable systems and improve access controls and data protection ^[8]. A bank that reads the chip and then keeps a digitised copy would hold the same kind of file the FSA is worried about ^[14]. The call may also stay a call. The report describes a push to accelerate and does not include a deadline, a cost or a penalty ^[1].

Senior politicians are describing this as an emergency. Masaaki Taira, who heads the Liberal Democratic Party's National Cybersecurity Strategy Headquarters, described the situation as "a state of emergency in cyberspace" ^[6], and cybersecurity minister Toshiharu Furukawa warned of an exceptionally serious challenge ^[7]. In our view, banks hearing that language will treat the FSA's request as binding before it is. Banks that build chip reading into onboarding ahead of any deadline may do it before spending on the storage systems the experts quoted in the report say still need work ^[8].

We would be wrong if the licence images stay unsold and never turn up in account-opening fraud, because the 25 yen is an estimate with no completed sale behind it ^[13]. We would also be wrong if banks adopt chip checks and keep licences as an equal alternative, since the cheapest document in the story would still be one that opens an account ^[2].