What Japan's Brokerage Account Takeovers Teach About Designing Login With Passkeys

More companies are asking me some version of this: "We want to support passkeys, but we worry users will get confused and leave."

That worry makes sense. But for the past year and a half, the industry in Japan that faced this problem at the largest scale was online brokerage. The numbers and the industry's guidelines are public. Even if you are not a brokerage, they are worth reading before you touch your login.

I am not a security specialist. I design and build login and signup screens, and that is the angle I am writing from.

What happened

The Financial Services Agency keeps a warning page on unauthorized access and trading in online brokerage accounts, mostly using login details stolen through phishing sites that imitate real brokerages.

According to the figures updated on October 9, 2026, from January 2025 through September 2026 there were 19,252 cases of unauthorized access, and 10,642 of them went on to unauthorized trading. April 2025 alone, the worst month, had 3,033.

Total sales in those unauthorized trades came to about 437.2 billion yen. The agency notes that this is the total traded inside the affected accounts and does not equal what customers lost. All figures are provisional.

How the industry responded

On October 15, 2025, the Japan Securities Dealers Association revised its guidelines for preventing unauthorized access in online trading. For important actions such as logging in, withdrawing money and changing the bank account for withdrawals, firms must implement phishing-resistant multi-factor authentication and make it mandatory, on by default. The examples given are passkeys and authentication based on public key infrastructure.

At a meeting with the industry association, the agency asked firms to make it mandatory by the end of June 2026 as a rule.

The figures for July 2026 show 5 cases of unauthorized trading, 25 in August and 2 in September. That lines up with the deadline. The documents do not establish cause and effect, so I will leave it at the numbers.

The design questions inside the brokerage guidelines

The guidelines are a technical document, but read closely, they contain three design decisions.

1. Turn it on by default instead of offering it as an option. The guidelines say mandatory, set as the default. If "Enable passkeys" sits deep in settings, most people will never switch. The flow has to let people register right after they log in, or the next time they log in, without leaving the screen.

2. Give people who cannot use it another path. The guidelines ask firms to offer an alternative form of multi-factor authentication to customers who turn it off because, for example, they do not own a smartphone. They also ask firms to track the opt-out rate and revise their authentication methods to bring it down. That opt-out rate is your design report card.

3. Check again at every important action. Logging in is not the only moment covered. Withdrawals and changes to the withdrawal account are included. Ask for the passkey again right before money or personal data moves. Skip this and a solid login still leaves another door open.

What carries over if you are not a brokerage

Services where people collect points, apps that hold a balance, member sites that store a lot of personal data. Phishers go after them for the same reasons they go after brokerage accounts.

When I help add passkeys, I pay the most attention to three things.

The words. Plenty of people still do not know what a passkey is. Write the first explanation in terms of what the person does: "Log in with Face ID or your fingerprint, no password." Put the explanation of how it works behind a link for the people who want it.

New phones and account recovery. Most passkeys carry over to the same person's other devices through their Apple or Google account. Even so, some people will lose a phone or switch from Android to iPhone. If the only way to recover an account is a code sent by email or SMS, that is where attackers will aim. Recovery screens deserve as much time as the login screen.

What to measure. Login success rate, time to log in, the share of users who registered a passkey, the share who turned it off, and the number of login-related support requests. Start measuring before the change and you can show its effect in numbers.

At the first meeting

If you are reviewing your login, tell me three things at the first meeting: how login and account recovery work today, how many login-related support requests you get and what they are about, and, if you have it, the breakdown of your users' phone models.

With those three, we can find out who gets stuck where before passkeys become mandatory.