PayPay Ends Photo ID Checks, Moves to IC Chip Reading Before 2027 Rule

Japanese payment app PayPay will stop accepting identity checks that rely on photographs of ID cards by early November 2026 and will read the IC chip in the card instead. In a press release on 23 October, the company said the change covers applications made with a My Number Card, a driver’s licence or a driving history certificate.

PayPay gave a direct reason. “Incidents have recently occurred in which personal information, including images of driver’s licenses, was leaked due to cyberattacks, and the risk of impersonation and other misuse of images of identity verification documents has been increasing,” it said. The company did not name the incidents.

It is also moving early. The Japanese government will abolish photo-based remote ID checks for regulated businesses from 1 April 2027, and PayPay said it would act “prior to the amendment to the Ordinance for Enforcement of the Act on Prevention of Transfer of Criminal Proceeds scheduled for April 1, 2027”.

How PayPay users will verify their identity

Users will need PayPay app version 4.28.0 or later. PayPay lists three routes for Japanese ID cards:

• My Number Card with its password. The user enters the 6- to 16-character password set when the card was issued, and the app reads the chip and the card’s signature certificate. PayPay says this can take “as little as two minutes”.
• My Number Card without the password. The user types in details printed on the card, completes facial recognition and lets the app read the chip. PayPay suggests this route for people who have forgotten their password.
• Driver’s licence. The app reads the licence’s IC chip and uses the information recorded on it.

Residence Cards and Special Permanent Resident Certificates are covered on a separate help page.

PayPay frames identity checks as part of its compliance work. It said it treats eKYC as a key way “to counter criminal activity and unauthorized use and strengthen anti-money laundering (AML) and counter financing of terrorism (CFT) measures”. It added: “As of September 2026, the number of users who have completed identity verification (eKYC) has exceeded 44 million.” The company also points to encryption, round-the-clock monitoring for unauthorised communications, and vulnerability testing of its app by internal and external experts.

What Japan’s rule change abolishes

The rule PayPay is getting ahead of is set by the Act on Prevention of Transfer of Criminal Proceeds, Japan’s main anti-money-laundering law, and its enforcement ordinance. The National Police Agency, which is responsible for the law, consulted on the amendment from 28 February 2025. It published the final result on e-Gov on 24 June 2025, the day the amendment was promulgated.

In its response to the 83 comments, the government said the method in which a business receives images of an ID document and the customer’s face would be abolished as proposed. The reason, it said, is that receiving images of ID documents carries a high risk of impersonation through forged or altered documents. Receiving photocopies of ID documents by post goes as well. Methods the government sees as lower risk stay. These include the My Number Card’s public certification and reading the IC chip on a document such as a driver’s licence, alongside a face image.

Some respondents asked for faster action, and others asked for a delay. The government kept the 1 April 2027 start date. It said recent money-laundering trends call for action as early as possible, but businesses need time to rebuild their systems and update their manuals.

Why a leaked licence photo is now treated as a fraud risk

Both PayPay and the government make the same argument. A photographed card is just an image, and images can be copied, edited or reused. That matters more in Japan this year, where breach notices have stacked up. TSN has tracked a wave of admissions from Japanese firms and the hack of GMO’s Desktop Cloud service, where trading logins were stolen. Neither PayPay nor the government links its decision to any one incident.

Chip reading is harder to fake. The National Police Agency’s Q&A on the amendment says businesses must confirm that IC-chip data is genuine. One way, it says, is to verify the digital signature that comes with the chip data, rather than trusting what a camera sees.

The change also has costs and gaps. People without an IC-chip document or an NFC phone keep a postal route: under the new rules, they can post certain original documents with anti-forgery features. The Q&A also says accounts opened under the old photo method need not be checked again under the law. PayPay has not said how many of its 44 million verified users went through the photo route, or whether it will ask them to re-verify. That is the open question for anyone whose licence image may already be in the wrong hands.

A deadline for everyone else

PayPay is five months early, but the deadline applies to every business covered by the law, from banks to card issuers. From 1 April 2027, any Japanese firm that still asks customers to photograph their driver’s licence will be using a method the law no longer accepts.

TSN follows breaches and their fallout on its ransomware and cyber attacks hub, and security fixes that protect users on its Tech for Good hub.

Sources

• PayPay Corporation, “PayPay to Discontinue Photo-Based Identity Verification (eKYC) Applications Using My Number Cards, Driver’s Licenses and Driving History Certificates and Standardize on IC Chip Reading”, 23 October 2026
• e-Gov public comment, 犯罪による収益の移転防止に関する法律施行規則の一部を改正する命令案 (result notice; competent authority: National Police Agency), 24 June 2025
• Results of the public comment and the government’s views (in Japanese; TSN’s translation), 24 June 2025
• National Police Agency (JAFIC), 犯罪による収益の移転防止に関する法律施行規則の改正に係るＱ＆Ａ (in Japanese; TSN’s translation)

Related stories

• Japan’s Data-Breach Wave: What Bookoff, Times Car, skyticket, Lawson, Resorttrust and Others Have Admitted
• GMO Says 26,739 Desktop Cloud Servers May Be Affected After Hack, Halts Service