Japan’s Financial Services Agency is steering retail banks and securities firms toward passkey-first authentication, telling supervised institutions to treat phishing-resistant logins as the default for high-risk actions such as sign-ins, wire transfers, and profile changes.
What the revised manuals require
Updated comprehensive supervision guidelines circulating this month tell lenders to deploy multi-factor methods that resist fake login pages—passkeys or public-key infrastructure certificates—rather than one-time codes sent by SMS. Institutions may still grant exceptions for customers without smartphones, but they must track how often users opt out and shrink that share over time.
Until passkeys are universal, banks must pair interim factors with behavioral monitoring: login alerts, velocity checks on transfers, and rapid account locks when sessions look hijacked. Email and SMS templates may no longer include clickable password-reset links except where law mandates them, pushing users toward bookmarked sites and official apps.
Why card customers should care
Credit card divisions often sit on the same digital banking stack as deposit accounts. When MUFG, Sumitomo Mitsui, or Japan Post Bank migrate retail users to passkeys, co-branded card portals typically follow. That matters for households that pay balances through mobile apps vulnerable to overlay attacks.
Reward programs that rely on e-commerce logins also benefit. Fraudsters increasingly test stolen card numbers with micro-charges before maxing limits; stronger login controls at the issuer gateway reduce downstream dispute volume.
Implementation timeline
Major banks began piloting passkeys after Apple and Google standardized the technology, but adoption lagged because call centers feared higher support costs. The FSA’s language removes ambiguity: institutions need a published schedule showing when passkeys become mandatory, not optional.
Smaller shinkin banks and online-only challengers may partner with shared authentication vendors to meet the bar without building bespoke apps. Consumers should expect in-app prompts this winter, plus educational mailers showing how to register devices.
Limits of the policy
Passkeys cannot stop every scam. Voice-phishing that tricks retirees into transferring cash offline still dominates loss tables. Digital Agency officials separately urged citizens to bookmark official sites after a police survey found phishing mail hitting more than four in ten institutions.
Still, for cardholders who live on mobile banking, the FSA’s push is the clearest sign yet that passwords alone are no longer acceptable for Japanese retail finance.