October 13, 2026, 8:00 a.m. (JST)
[Japan] BankGuard has developed “Emoji Authentication,” a system that leverages the difficulty of manually entering emojis to make real-time phishing attacks more difficult, while simultaneously offering the same ease of use as traditional one-time passwords (OTPs).Emoji Authentication can be used to supplement passkeys, or it can be used on its own for logging into member sites and for 3-D Secure. BankGuard’s CEO, a Doctor of Engineering, explained the principles behind Emoji Authentication, which the company has named “Super One-Time Password” (Super OTP).(From a presentation at the “Payment Security Forum 2026 Fall” held on September 25, 2026)
Haruhiko Fujii, Ph.D. (Engineering), Representative Director, BankGuard Co., Ltd. (Visiting Professor, University of Professional Studies for Information Innovation; Member, Technology and System Review Working Group, Anti-Phishing Council)
Emoji authentication leverages
the difficulty of manually entering emojis Achieving ease of use equivalent to OTP
Today, I would like to speak on the topic of “Strengthening Passkeys with Emoji Authentication.” This presentation focuses on three main points. First, the principles and operation of emoji authentication. Second, how it complements passkeys. Third, the fact that it can be used on its own, without needing to be combined with passkeys. I will explain these points in three separate sections.
The first point, “The Principles and Operation of Emoji Authentication,” is that emoji authentication leverages the difficulty of manually entering emojis. The keyword “manual entry” is important. There are three ways to defend against real-time phishing attacks:You can use a takedown mechanism, a passkey, or leverage the difficulty of manual entry. Using all three provides the highest level of security.
Emoji authentication is a method that leverages the difficulty of manually entering emojis to make real-time phishing attacks more difficult. Here’s the key point: it simultaneously achieves the same ease of use as traditional OTP. This technology offers the same operability and convenience as traditional OTP, allowing anyone to use it without needing a manual.
The strength of this technology is that 100% of users can use it. I’m not dismissing technologies that only 90% or 70% of people can use. However, since “the remaining users who can’t use it” are the ones who end up falling victim to attacks, it’s crucial to protect against that.
Second, it serves as a complement to passkeys. Passkeys are excellent, but there is a certain number of users who cannot use them. Given that, there are phases where we have no choice but to use OTP. In other words, even if we reduce manual entry and OTP usage, they still remain in the system, and that’s where attacks occur. Even if a passkey is compromised, it can still be used as a backup authentication method.My personal belief is that, as a countermeasure against phishing, multiple forms of multi-factor authentication should be used. If you rely on just one authentication method, that’s where you’ll be compromised. Using emoji authentication as a backup authentication method yields dramatic results.
Third, it’s an independent authentication technology that can be used on its own and isn’t dependent on any specific other technology. Emoji authentication can be used independently, even for 3-D Secure when logging into membership sites. Even if you only use it once every few years, this technology remains viable and isn’t subject to trends.
Researching the “Shared Encryption Key” Problem That Can Never Be Solved
My name is Haruhiko Fujii, Ph.D., and I am a former researcher at NTT Laboratories.I conducted research for many years at the Musashino Telecommunications Research Laboratory, where I devised two-path authentication. “Phone authentication” refers to registered phone authentication, in which a user makes a call when logging into a website and logs in by transmitting their caller ID. I hold the basic patent for this technology. I earned my Ph.D. based on this work, and the NTT Group subsequently commercialized it.
I’ve been in this field for about 25 years now. I’ve been working on the same things all along: alternatives to passwords for logins, multi-factor authentication, two-factor authentication, emoji authentication, and phone authentication. Back when I was a cryptography researcher, there was a problem in the world of cryptography that was considered unsolvable: “How do you securely deliver a password or public key to another party?”Additionally, there are problems known as “how to securely register biometric data” and “key exchange,” which are considered unsolvable forever. However, by using phone authentication, two-factor authentication, and emoji authentication, we have partially solved these issues. This means we’re seeing tangible results.
I’ll explain the options for standalone implementation and combined use with Passkeys. We refer to emoji authentication as “Super One-Time Password” (Super OTP). Authentication using Super OTP alone is possible. It can be used for member site logins and 3-D Secure identity verification. It can also be used in combination with Passkeys without any issues.
It serves as a backup in case the passkey or SMS is compromised. Even if users typically log in using a passkey, it strengthens the OTP used for registration, changes, and recovery, and can also be utilized for authentication for users who do not use passkeys. It can be implemented on its own or used in conjunction with passkeys even after they have been introduced.
Real-time phishing attacks involve tricking users into entering their ID and password on a phishing page. These simple attacks are particularly problematic because they are inexpensive to carry out. Super OTP is a highly recommended technology specifically designed to counter this threat.
Super OTP is a new two-factor authentication system that uses emojis and images for identity verification—a process that was previously done by entering numbers. When you enter your ID and password as usual, an image that changes every time is sent to you via email or SMS. All you have to do is select the image you received from the options on the verification screen.
There are no communication fees for recipients. Standard OTPs have been compromised by attackers inserting fake websites between the user and the legitimate website. If a user enters the OTP they received without realizing the site is fake, the entered information is stolen, resulting in an unauthorized login.
In contrast, Super OTP uses emojis instead of numbers. Therefore, even if a fake input form is created, emojis cannot be typed. Furthermore, even if an attacker attempts to create a fake image selection screen, they cannot predict the exact image the user received and replicate it. Consequently, this protects users from unauthorized logins. Note that this service is also available via email, not just SMS.With patents in four countries—Japan, the United States, China, and Singapore—and having received various awards, including the Invention Grand Prize and Encouragement Award sponsored by the Patent Office, we continue to lead the fintech market. Super OTP is a next-generation authentication tool for the “with COVID-19” era, combining unparalleled security with ease of use for everyone.
Real-time phishing attacks render
OTPs ineffective Leading to a massive collapse of online authentication
In real-time phishing attacks, users are lured to phishing sites and enter their user IDs and passwords. When the hacker enters this information into the legitimate site, the password is sent from the legitimate site to the user. Users used to believe this was safe because the password didn’t go to the hacker, but what they’re actually viewing is a spoofed site.A prompt appears saying, “Please enter the OTP you received,” and the user, without a hint of suspicion, quickly types it in. This “quick typing” is the key. Once the user types it in, the hacker can steal the information, enter it on the legitimate site, and successfully log in—it’s as simple as that.
Since this appears to come from the legitimate site, DMARC verifies it as valid. Because the email is legitimate, users trust it and enter the code. DMARC is a wonderful technology, but since the OTP is legitimate, users are bound to trust it. This attack exploits that very vulnerability.
OTP is the only part that’s tricky—it has nothing to do with SMS or email. The same attack can be carried out even with hardware OTPs. The same applies to apps and voice calls; similar attacks are possible. For more details, please refer to my doctoral dissertation. Even if you include letters or symbols in the OTP, if it can be entered “tap-tap-tap,” it’s all the same. This represents a massive collapse of authentication on the Internet.
■Contact
Information 
BankGuard
Co., Ltd. URL: www.bkguard.com
