October 28, 2026, 9:02 a.m. (JST)
[Japan] Fraud and cybersecurity crimes are becoming major social issues. While security attacks targeting credit cards are part of this problem, the reality is that the payment industry alone can no longer fully prevent these threats—including countermeasures against increasingly sophisticated phishing attacks.Hideyuki Maruyama, a payments expert, discussed trends in payment security measures both domestically and internationally while looking back on the history of credit cards—a history that could also be described as the history of fraud prevention. (From a presentation at the “Payment Security Forum 2026 Fall” held on September 25, 2026)
Hideyuki Maruyama (Payment Industry Expert)
Payment Security Measures Alone Are Not
Enough Cybersecurity as a Social Issue
The topic for this session is “Trends in Fraud Prevention Measures for Domestic and International Payments.”I’ve had the opportunity to speak at this Payment Navi “Security Forum” for about 10 years, dating back to the days of its predecessor, the “Credit Card Security Forum.” Each time, the overarching theme has been “Trends in Fraud Prevention for Domestic and International Payments,” and this time is no different in that regard.
The history of credit cards can, in a sense, be described as the history of fraud prevention. So, this time, I’d like to take a brief look back at the situation from a few years ago.In the credit card payment ecosystem, cardholders use their cards at merchant locations, and there are issuers and acquirers. Previously, security measures were focused solely on this payment ecosystem; however, today, fraud prevention measures limited to this ecosystem alone are no longer sufficient, and countermeasures now also incorporate AI and passkey technologies from areas outside the payment sector.
In the sense that these measures extend beyond the payment ecosystem, it can be said that fraud prevention in payments has become synonymous with cybersecurity itself.
Over 30 Years of Experience
in the Payments Industry Security Measures for the Next Generation
I previously worked at Mastercard and American Express. I have been in the payments industry for over 30 years. During my time in a security-related role—around 2015 and 2016—the Ministry of Economy, Trade and Industry (METI) established the “Credit Transaction Security Measures Council” in collaboration with industry associations, and I served as a committee member from its inception. I am currently working as a freelancer.
Different
Perspectives and Definitions of “Fraud” The Issuer’s Perspective vs. the Merchant’s Perspective
Regarding the very definition of fraud, I have personally felt for many years that there is a discrepancy between the Issuer’s perspective and the Merchant’s perspective. This is because the definition of fraud from the Issuer’s perspective—the entity that issues the cards—overlaps with, yet also differs from, the definition of fraud as seen by Merchants.
Simply put, fraud from the Issuer’s perspective corresponds to the figures reported to the Japan Credit Association. Specifically, this includes “counterfeit cards” and “stolen card numbers”; in principle, any card use by a third party other than the cardholder is considered fraudulent.
In addition—and this seems to be emerging as an issue for issuers recently—there is a type of fraud other than third-party use; in other words, fraud that might have been committed by the cardholder themselves. Overseas, this type of fraud has long been referred to as “family fraud” or “friendly fraud.” Specifically, this includes instances such as a child making unauthorized tip payments with a card or a parent’s card being used without permission to make in-game purchases.
Another type of fraud that issuers must manage is money laundering, which in Japan falls under the Act on Prevention of Transfer of Criminal Proceeds.
On the other hand, from the Merchant’s perspective, the purchase of goods for resale is also considered fraudulent. In fact, high-priced resales of limited-edition items and tickets have become major topics of discussion. However, these figures are not included in the Japan Credit Association’s reports on fraud losses. I feel that this discrepancy in perspective is a key challenge.
Furthermore, merchants tend to believe that if they have implemented 3-D Secure and have no chargebacks, they have suffered no fraud losses. From the Issuer’s perspective, however, reports from cardholders are processed as fraud, leading to a discrepancy in understanding.
The Same Pattern
from the Issuer’s and Merchant’s Perspectives Different Perspectives on Fraud Even Within the Same Company
I’ve often witnessed situations where department heads from different divisions—such as the Authorization Division and the Merchant Management Division—at a credit card company would sit side by side in the same meeting and say to each other, “Huh? Is that so?”Personally, I often wonder: “How can they combat fraud when there isn’t even coordination within the card company itself?” To outsiders, it may seem like card companies are using AI to implement cutting-edge fraud prevention measures, but I’m personally very concerned that the reality from the Merchant’s perspective is somewhat different.
In fact, this clearly affects the so-called Authorization Rate and 3-D Secure authentication rates—and it’s not something that can be easily resolved. In terms of the definition of fraud, since authorization and 3-D Secure are managed from the Issuer’s perspective, Merchants say they have to implement countermeasures individually on a case-by-case basis.
Data theft
via magnetic stripe readers Reselling luxury brand accessories immediately after purchase
Looking back at the history of fraud, when I first entered the card industry, chip-based payments didn’t exist, of course. Since this was an era before the internet, it was the age of magnetic stripe cards. Back then, there were occasional reports of counterfeit cards being made.Inside so-called CAT terminals (shared-use terminals), accomplices of fraudsters—who had infiltrated the system by working as part-time employees—would attach memory cards to the magnetic stripe readers. These devices were about the size of a matchbox, but if left in place for three or six months, they would accumulate data from swiped cards, allowing the card information to be extracted.The data that accumulated automatically included information from corporate cards and high-limit cards. The practice of using this data to create counterfeit magnetic stripe cards for fraud was a hot topic in the security community at the time.
When comparing the methods used back then to extract card numbers with those used today, I personally feel that the only difference is that the activity has shifted online. As for what criminals do with the stolen card numbers—the basic approach of purchasing goods and reselling them—hasn’t changed much.
Now, the main battleground for fraud has shifted online, and while the necessary elements—such as product delivery and the use of parcel lockers—have changed, organized fraud schemes like those seen in specialized scams have existed since back then; I feel that the methods are simply evolving as times change.
Which is stronger: defensive AI or offensive AI?
The adoption of passkeys has been slower in Japan compared to other countries
As fraud methods evolve, countermeasures naturally have to change as well. For example, magnetic stripes were replaced with chips to make them significantly harder to counterfeit. Similarly, I believe we’ve been steadily moving toward the era of 3-D Secure, tokens, and Passkeys.During this time, PCI DSS has also been regularly updated, and there have been reports that the next revised version will be released in 2027.
Looking at the history of fraud, techniques have shifted from the era of counterfeit cards to the era of card number theft. AI is also being used. Real-time phishing has become commonplace. Techniques such as impersonation and account takeover have evolved with the times, but the fact remains that criminals are still out there. It’s also true that the scale of these crimes is gradually increasing.
In this current AI era, there are reports that AI is used to scan for vulnerabilities in target companies’ systems and launch attacks from there, while on the defensive side, AI is also being used to analyze fraudulent data and aid in detection.I’ve also been asked, “What happens in an ‘AI vs. AI’ scenario?” The question is: if AI is on both the attacking and defending sides, which AI would win? Personally, I believe the attacking side would prevail.
The defending side is essentially forced to focus first on preventing patterns seen in past incidents from occurring—and if they do occur, stopping them as quickly as possible. For the AI-powered defense, the strength lies in analyzing past data as quickly as possible to prevent secondary damage. The attacking side, on the other hand, searches for vulnerabilities to bypass those defenses.I’ve heard that when vulnerabilities are currently being searched for, many are being discovered on e-commerce sites, as well as at banks and securities firms. I’ve also heard that even when fixes are applied, they can’t keep up. If that’s the case, then the attacking side clearly holds the advantage.
In addition, I believe we should fundamentally adopt FIDO2 and passkeys as authentication measures.When it comes to passkeys, this is where I feel most strongly that the pace of adoption in Japan is clearly lagging behind that of other countries. Just as the Tokyo Metropolitan Police Department and the National Police Agency strongly promoted their adoption during the securities fraud incidents, I believe not only securities firms but also banks, online banking services, credit card companies, major e-commerce sites, and platform operators should adopt them.
To
Learn About Security Measures Recommended Websites for Information
In terms of fraud prevention trends, the focus is shifting from payment-specific fraud prevention to broader cybersecurity measures. Payment fraud prevention typically involves magnetic stripe cards, chip cards, 3-D Secure, and network tokens. However, these measures are limited to what payment brands provide, so cybersecurity-based fraud prevention is ultimately necessary.
Regarding security measures, I believe it’s important to monitor the overall trends by reviewing information from the National Cybersecurity Office, the Tokyo Metropolitan Police Department’s Cybersecurity Information Center, the Japan Cybercrime Response Center (JC3), and the Anti-Phishing Council.Since payment fraud itself is just one part of the overall crime landscape, I believe that cybersecurity should be the central focus, with payment-related issues emerging from that context.
Thank you for your attention.
