Japanese Securities Firms Introducing Passkeys to Prevent Account Hacking

The Yomiuri Shimbun

17:43 JST, November 10, 2025

Major Japanese securities companies are introducing passkey authentication systems, which utilizes biometrics such as fingerprints and facial recognition, among other methods, to enhance security.

The Yomiuri Shimbun has conducted a survey on 10 major securities firms, and six said they have already introduced such a system, with the remaining four planning to introduce one by spring.

With the move, the securities companies aim to prevent accounts being hacked. The hacking of securities accounts and subsequent unauthorized stock trades have become a problem in Japan.

Experts point out that ensuring users know about the system is expected to be a key challenge.

Of the 10 securities firms, Nomura Securities Co., Daiwa Securities Co., SMBC Nikko Securities Inc., Mizuho Securities Co. and Mitsubishi UFJ Morgan Stanley Securities Co. provide their services mainly through face-to-face interactions. The remaining five are online brokers — SBI Securities Co., Rakuten Securities Inc., Monex Inc., Mitsubishi UFJ eSmart Securities Co. and Matsui Securities Co.

The passkey system is an authentication method based on standards set by the FIDO Alliance, an industry group formed by major global tech companies. In passkey systems, two electronic “keys” are generated, with one stored on the user’s device and the other stored on a server used by the service provider. Users then log in using such methods as biometric authentication, rather than entering a password. Use of such system is said to lower the risk of being hacked.

From late November, Nomura Securities will make passkey authentication mandatory for stock trading, replacing other verification methods such as one-time passwords. Since late October, Rakuten Securities has enabled passkey use for logging into its websites and apps. However, the securities companies are divided on whether to make passkey authentication mandatory or optional. “Some people don’t have devices that support passkeys, so we need to consider what to do in such cases,” a source from a securities firm said.

Unauthorized online trades rampant

According to the Financial Services Agency, unauthorized online stock trades using hacked securities accounts totaled about ¥690 billion from January to September. There were 15,873 instances of unauthorized access to accounts during the period, with many of them occurring through phishing scams, in which users are tricked into revealing passwords via fake sites.

In mid-October, the agency and the Japan Securities Dealers Association each revised their guidelines, requesting securities companies and other firms to make the use of advanced methods like passkeys mandatory for multi-factor authentication.

WealthNavi Inc., a company that provides asset management service, introduced a passkey system in early September. The company said more than 100,000 people used the method in the first month, accounting for about a quarter of its total users. The company said it has received feedback from customers that the system is more convenient than passwords.

“Dissemination of the passkey system is crucial in preventing damages (caused by hacking),” said Kei Tani of Daiwa Institute of Research. “It is also important for companies to raise customer awareness regarding security.”