The Information-technology Promotion Agency and Visa Japan published a joint advisory Friday warning rail operators and convenience franchises to inspect QR-code payment panels after Tokyo-area officials confirmed counterfeit stickers overlaid on legitimate kiosk decals. The alert follows a week in which at least eleven machines across major JR East concourses showed tampered codes that attempted to redirect mobile-wallet payments to unauthorized merchant accounts before staff removed them during routine cleaning.
How the overlay worked
Attackers printed high-resolution stickers mimicking official Visa and domestic wallet branding, then affixed them atop existing static QR plates on ticket vending and charge machines. Commuters scanning the top layer opened phishing pages that requested card details or wallet login tokens. Because the underlying hardware remained genuine, quick visual checks often missed the overlays until transaction error rates spiked.
IPA incident handlers said the stickers used UV-resistant laminate to survive outdoor station air for several days. Cleaning crews now receive magnifier cards to feel for edge bumps.
Scope and response
JR East confirmed internal patrols intensified around Tokyo and Ueno stations but declined to list every affected device, while coordinating with the National Police Agency cyber unit. Officials asked the public to report stickers that peel or reflect differently from surrounding panels.
Visa Japan disabled merchant IDs linked to the unauthorized flows and reissued authentication keys to unaffected kiosk aggregators. Wallet providers pushed in-app warnings when users scanned codes geolocated to recently flagged stations.
Merchant guidance
The IPA-Visa bulletin tells operators to adopt tamper-evident seals, rotate QR payloads dynamically where hardware supports screens instead of stickers, and log nightly photos of panels for comparison. Convenience stores with similar static codes at drink machines were urged to audit during Saturday restocking, ahead of expected Climax Series baseball crowds moving through Tokyo hubs.
Payment service providers must file incident reports within 72 hours under updated FSA guidelines on non-face-to-face payment abuse.
Consumer protection steps
Travelers should prefer tapping physical transit IC cards or using in-app tickets from official rail apps rather than scanning unknown codes on shared kiosks. If a scan opens a browser page asking for card numbers outside the wallet’s native UI, users should cancel and notify station staff.
Consumer Affairs Agency hotlines added a QR-skimming category after complaints rose in October.
Broader trend
Japan’s shift toward code-based payments reduced cash handling but created flat surfaces attackers can swap cheaply. Similar overlays appeared in Osaka last year on parking meters; Tokyo’s density makes detection harder during rush hours.
Yamato Transport’s separate data breach dominated headlines this week, yet IPA officials said physical sticker tampering remains cheaper for small-time groups than server intrusions.
What operators do Monday
Regional railways scheduled Monday morning conference calls with IPA engineers to standardize inspection checklists before the Diet returns and commuter volumes jump. Visa plans a webinar for franchise owners on dynamic QR adoption costs.
For riders passing through Tokyo Station this weekend, the practical rule is simple: if the code looks newer than the machine, do not pay through it—use the official app or a staffed window instead.