The next person who opens an account with your business could have someone else’s identity, a convincing set of documents and all the right answers to your security questions. Your systems may see a legitimate customer and by the time you realize something is wrong, a fraudster could already have access to services or sensitive customer data.
Japan’s National Cyber Coordination Office has issued a warning to businesses following multiple large-scale cybersecurity breaches in which customers’ personal data was stolen.
“These incidents involved the theft of data containing personal information, caused by the exploitation of vulnerabilities in web systems, compromise through supply chains, and insufficiently robust data management,” the agency stated.
Japan has seen a series of significant data breaches in 2026, potentially affecting millions of customers across travel, transport, retail and financial services. Travel-booking company Adventure, which operates Skyticket, reported the potential exposure of 14.64 million records, while a ransomware attack on cloud provider IDC Frontier put 6.09 million accounts at railway network JR East and 1.3 million at JR Kyushu at risk.
A vulnerability in VPN equipment led to a breach affecting around 246,000 records associated with Japan’s Digital Agency. Around 110,000 Daiwa Securities customers may have had their names and account numbers exposed in a breach at third-party provider Scala Communications. And Times Car operator Park24 reported an incident potentially affecting 6.6 million accounts, with around 1.6 million identity documents leaked, including driving license images.
The danger for enterprises extends well beyond the immediate fallout of a cyberattack. Once identity data is stolen, criminals can use it to undermine the verification checks that businesses rely on to establish trust.
When criminals obtain genuine identity documents, addresses, dates of birth and other personal details, they can use that information to impersonate legitimate customers. A person who passes an organization’s standard identity checks could be a criminal using somebody else’s stolen identity.
This creates a difficult problem at the intersection of cybersecurity, fraud prevention and customer experience. How do you know the person on the other end of a transaction is who they claim to be when the evidence used to establish their identity may already be compromised?
Mary Ann Miller, Fraud and Cybercrime Executive Advisor at Prove, explained in a recent interview with CX Today that organizations need to reconsider how much confidence they place in conventional identity checks.
“We’re looking at the nature of breaches becoming more targeted and going after what I call the treasure trove, which certainly driver's licenses are a treasure trove for the bad actors.”
Why Standard Identity Checks No Longer Prove Identity
Traditional identity verification often relies on information that is relatively easy to check but increasingly difficult to trust. A name, address, date of birth or driving license number may match the records held by a business but that does not establish that the person presenting those details is their rightful owner.
Miller believes this is where enterprises need to rethink their approach. “We really need to look at controls and signals that are outside the documentation that we can provide.” Miller pointed to the amount of personal information contained in identity documents, including details that criminals can exploit to make social engineering more convincing.
The risk is cumulative, as a stolen identity document can supply the basic details needed for an application, while other compromised information can help an attacker to answer security questions, impersonate a customer during a support call or persuade an employee to reset account access.
The Identity Check Needs To Follow the Customer Journey
Enterprises may respond to the increased risk of identity fraud by adding more verification steps. But requiring additional documents, one-time codes or manual reviews for every interaction can create unnecessary friction for legitimate customers, particularly when they need urgent access to an account or service.
Miller cautioned against assuming that more controls automatically deliver better protection: “I don't think more is already necessarily better.”
Instead, enterprises should review their existing identity controls to determine whether they remain effective, test them regularly against changing fraud techniques, and reassess controls more frequently when testing reveals weaknesses.
“We're way past the stage where that's a once-a-year routine,” Miller argued, describing the need for more frequent testing and risk assessments.
The practical implication is that identity verification should be risk-based and responsive to what a customer is trying to do. A routine login from a familiar device may warrant a different level of scrutiny from a request to change account recovery details, add a new payment recipient or move a large sum of money.
