November 4, 2026, 8:00 a.m. (JST)
[Japan] As the adoption of EMV 3-D Secure among merchants progresses, new challenges are emerging: for issuers, the burden of “liability shift”—where they bear the financial loss from fraud involving authenticated transactions—and for e-commerce merchants, “shopping cart abandonment and payment drop-offs” resulting from additional identity verification steps.Link has developed “UniPasskey,” an authentication platform using Passkey (FIDO2), and is proposing it as a solution to these challenges; the company has received inquiries from credit card companies, call centers, and others. (From a presentation at the “Payment Security Forum 2026 Fall” held on September 25, 2026)
Mr. Takashi Takimura, Executive Officer and General Manager of the Security Platform Business Division, Link Co., Ltd.
The
Most Sought-After Company for Card Security Consultations Link Releases UniPasskey and Enters the Passkey Market
For those of you who have attended Link’s sessions in the past, since we’ve often discussed PCI DSS compliance, I imagine many of you expected today’s topic to be the same. However, this year, Link released its passkey service, “UniPasskey,” and since the response has been very positive, I’m here today to share more about it.
I serve as an Executive Officer at Link.
I joined Link in 2011, so this marks my 15th year with the company. Since 2013, I have led the Security Platform Division, delivering services related to credit card security to our customers.I also serve as the chair of the Cloud Services Subcommittee of the JCDSC (Japan Card Information Security Council). This subcommittee now has over 100 member companies, and we’ll be holding a seminar next month. We’ve established a participatory format where member companies take turns presenting at the seminars, so I hope you’ll consider joining us if the opportunity arises.
Link was founded in 1987 and was engaged in advertising production for about 10 years. In 1996, we launched “at+link,” a managed hosting service, and have continued to provide IT services ever since.
Since this is an infrastructure service, we develop applications on top of it to offer SaaS, and we’ve built systems to provide them as PaaS. A prime example is “BIZTEL,” a SaaS-based telephone service—which might be best described as a cloud-based IP-PBX service. It is used by approximately 4,000 companies and has grown to become the largest service of its kind in Japan.We are a company that, like our business division, launches numerous cloud services related to credit card security, systematizes them, and sells them.
Our business unit was established in 2013. We launched “PCI DSS Ready Cloud,” a service designed to help customers achieve PCI DSS compliance through cloud services.While this service remains our core offering, we have also developed and launched other cloud services centered around the keywords “security” and “credit cards,” such as “Smart TG” (which complies with domestic regulations), the payment token service “Cloud Token for Payment Cards,” and the passkey service “UniPasskey,” which we’re introducing today.
Our division has a clear vision: “To become the company people turn to most often for questions and challenges regarding credit card security.” In terms of our activities, while anyone can submit an inquiry through our website, we also operate a dedicated consultation desk to assist those who have questions or concerns. I and other members of our team personally handle these inquiries. We also accept inquiries from consumers.
In addition, we jointly publish the “Cashless Security Report” with Kakkō Co., Ltd. once every quarter. This report summarizes trends in credit card fraud and is available for everyone to read free of charge.
https://pcireadycloud.com/blog/category/cashless_security_report/
Challenges
with One-Time Passwords Issues with input errors and wait times
Before moving on to the main topic, the total amount of domestic credit card fraud in Japan in 2025 was approximately 51 billion yen, a decrease of about 8% compared to 2024. However, the incidence rate is rising, and number theft accounts for over 90% of the total losses.While the adoption of 3-D Secure is progressing and the total amount of fraud is decreasing, a closer look reveals that the proportion attributable to card number theft is on the rise.
I have summarized the characteristics and challenges of the EMV 3-D Secure system. To avoid any misunderstanding, I should note that EMV 3-D Secure supports various authentication methods, such as passkeys and biometric authentication. However, since one-time passwords are currently the most widely used method, I would like to discuss the challenges associated with that approach.
In systems that issue one-time passwords via EMV 3-D Secure, it is impossible to completely eliminate fraud. Because phishing sites communicate with the genuine site in real time behind the scenes, users end up entering their one-time passwords on the fake site.Criminals who obtain one-time passwords use them to make unauthorized purchases or engage in fraud with the card, leading to incidents of one-time password theft through phishing.
Next is the concern about account takeover. You’re likely logged into the “My Page” section of the issuer’s member site, and in some cases, this is done using just a username and password. While authentication during payment is becoming increasingly robust, it poses a risk that the “My Page”—where authentication settings can be changed—is protected by nothing more than a username and password.
For example, a third party could gain unauthorized access to the user’s account, alter the registered information to change where one-time passwords are sent, or even register the victim’s card in their own smartphone wallet.
On the other hand, implementing EMV 3-D Secure may lead to a decline in the Authorization Rate. According to figures from our Cashless Security Report, while the Authorization Rate previously hovered in the 95% range, it has dropped to around 85% following the adoption of 3-D Secure, posing a risk of losing corresponding sales opportunities.
Incidentally, more than 65% of cardholders have experienced authentication errors, and some abandon the transaction at that point. Approximately 80% of Merchants report noticing an increase in abandoned carts.
The reason for this is that while a one-time password is sent to their smartphones, many users get stuck when entering it. Previously, shoppers could complete a purchase simply by entering the number and name printed on the card into the e-commerce site, but the password they’re supposed to receive often takes a long time to arrive.It usually arrives after about 5 seconds, but because it doesn’t come as quickly as users expect, some lose patience and abandon the transaction at that point.
Abandonment during the payment authorization process leads to a loss of sales opportunities. This type of abandonment is particularly likely among users who are not accustomed to e-commerce.Some people even give up on using e-commerce sites from the start because they find the process confusing and feel anxious. Taking these factors into account, the implementation of EMV 3-D Secure has led to a certain percentage of abandoned carts and purchases that never materialize in the first place.
Overcoming
the Shortcomings of One-Time Passwords Facial or fingerprint authentication eliminates the need to remember or enter passwords
We’ll now discuss how PassKey can improve this situation. PassKey performs authentication using a private key securely stored within the device.In what is known as “challenge-based authentication,” when a challenge is sent from the server during the 3-D Secure authentication process, the user unlocks the device using facial or fingerprint recognition. The device then signs the challenge using the private key stored within it and returns that signature to the server to complete the authentication. The private key itself never leaves the device.
A key feature of Passkey is that it eliminates the risk of password leaks. Since the server holds only the public key, even if it were leaked, the risk of misuse based solely on the public key is relatively low.Regarding phishing resistance, the system is designed to prevent authentication from succeeding on fake website domains. Additionally, it employs a two-factor authentication model combining “possession” and “biometrics.” Since the system requires both the user’s device and biometric authentication—such as a face or fingerprint—it prevents unauthorized use by others, thereby reducing that risk.
There is no need to memorize or enter anything, so you no longer have to remember passwords. Furthermore, since it is a standard feature of the operating system, no additional apps are required. It can be used as a standard feature on Apple, Google, and Microsoft platforms. It is a standard specification and complies with FIDO2 and WebAuthn.
When comparing this to one-time passwords or traditional ID-and-password systems, it goes without saying that it scores top marks in terms of security and offers a higher level of protection. In terms of usability, it eliminates the hassle of having to wait for a one-time password to be sent and then enter it.Authentication is granted simply by facing your smartphone, making it extremely easy to use. I believe we’ll see this type of biometric authentication emerge in various settings going forward. While operational considerations—such as recovery procedures in the event of a lost device—are necessary, the Passkey system successfully balances security and ease of use.
■Contact
Information 
Link
Co., Ltd. 107-0061
2-14-4
Kita-Aoyama, Minato-ku, Tokyo Argyle Aoyama, 14th
Floor TEL: 03-6704-9090
https://pcireadycloud.com/
Inquiries: https://pcireadycloud.com/guest/
