Japan’s Financial Services Agency is steering retail banks and securities firms toward passkey-first authentication for high-risk online actions, according to supervisors briefing lenders this week on revised internet-trading guidance that treats static passwords and SMS one-time codes as insufficient against modern phishing, Yuki Sato’s credit-cards desk reports.
What “default” means in practice
The proposed supervisory text does not ban passwords overnight. It tells institutions to ship phishing-resistant multi-factor authentication—passkeys and public-key options are named examples—as the default path for logins, outbound transfers and profile changes, while documenting alternative methods for customers who cannot use smartphones. Banks must publish implementation timelines and track how many users remain on legacy flows.
That matters for cardholders because the same login session often gates credit-card payment portals, loan redraw tools and brokerage cash sweeps. When attackers defeat SMS OTP with real-time relay pages, the FSA’s message is that liability and reputation sit with the institution, not the customer who tapped approve.
Who is moving first
Digital banks that already market passwordless logins are using the guidance to justify turning off SMS for routine access. GMO Aozora Net Bank rolled passkey login in July, pairing biometric unlock with FIDO-compliant keys stored on-device. Mega-banks are slower but face the same deadline pressure from fraud-loss statistics the FSA cites in industry dialogues.
Card issuers should expect call-center scripts to change: customers who refuse passkey enrollment may see tighter transaction limits until they adopt stronger factors. Merchants are indirect beneficiaries if fewer stolen credentials reach card-not-present fraud rings.
Household checklist
If your bank offers passkey enrollment, register on a phone you control before attackers social-engineer a reset. Keep a backup device within the issuer’s registration cap. Watch for fake “security upgrade” emails that mimic the FSA logo—official policy moves through your institution’s authenticated app, not a cold link.
Sato’s desk will log which lenders publish opt-out rates and whether credit-card apps inherit the same default rules as deposit accounts this quarter.
Brokerage and card overlap
Securities apps that share login shells with credit-card portals must migrate both surfaces together; otherwise attackers will target whichever lane still accepts SMS codes. Regional banks running legacy ASP cores told supervisors they need phased rollouts through March 2027, but the FSA expects interim detective controls—velocity limits, device fingerprinting—to tighten each quarter.
Payment-service providers that embed bank SSO should publish passkey readiness in merchant developer docs so fintech wallets do not become the weak back door.