A leaked license image: risks and defenses (Times Car)

A breach at the car-sharing service Times Car leaked driver’s license images and other documents from about 1.6 million accounts. The question most people have is whether an image alone can be used to open an account or a loan in their name.

This article first sorts out what has been published about the incident. It then checks, against published sources, how license images are used in identity checks, cases of misuse, and the countermeasures that public bodies describe. The operator says it has not confirmed any unauthorized use of the information. What follows is what can happen in general. No misuse in this incident has been published.

What has been published about the incident#

The operator is Times Mobility, a consolidated subsidiary of Park24. The official first to third reports and the Q&A updated on October 6 state the following.

Item	Details
Detection and blocking	Detected at 9:07 on September 25. The intrusion route and communication with the attacker were blocked by 7:25 on September 26
Accounts leaked	About 6.6 million. Includes people who had left the service, people who never completed enrollment, and Times Business Service members
Accounts with ID documents leaked	About 1.6 million
Document images leaked	Driver’s license, proof of current address (such as a utility bill), student ID (student plan), family relationship document (family plan)
Other information	Name, address, date of birth, phone number, email address, driver’s license information, and more
Credit card information	Not held by the operator, so not part of the leak

The first to third reports and the Q&A say nothing about the cause, the intrusion route, or the attacker. Measures to prevent recurrence are to be announced in a later report. Compensation will be decided after the findings of an external expert body and has not been decided yet. The Akita Sakigake Shimpo reports a move toward a class action: more than 10,000 people had registered on a lawyer’s site calling for a suit by 1:00 p.m. on October 2.

The Q&A explains why data was kept after people left. Name, address, and date of birth were kept for seven years under tax law and similar rules. Driver’s license information and images were kept for seven years for anti-impersonation measures and inquiries.

What can an image of a license alone do?#

The methods financial institutions use for online identity checks are set out in the enforcement regulation (Article 6, paragraph 1, item 1) of the Act on Prevention of Transfer of Criminal Proceeds. The main methods for individuals, as listed in FSA material, are these.

Method	Details
ホ (ho)	Send an image of a photo ID and an image of the person’s face through software provided by the institution. The document image must show name, address, date of birth, and photo, plus thickness or other features
ヘ (he)	Send the IC chip data of a photo ID and an image of the person’s face
ト (to)	Use the document image or IC chip data, plus a customer-information inquiry to a bank or a transfer to an account in the customer’s name
カ (ka)	Use the signing electronic certificate recorded on the My Number Card

Of the methods that use a license image, method ホ also requires an image of the person’s face. The operator’s Q&A mentions “matching against a face image of the person” and “confirmation through an account in the person’s name”; both correspond to methods in this table. The operator does not, however, fully rule out attempts at unauthorized applications by third parties, or fraud that combines other information and means.

A suspected case of opening an account with another person’s license image has in fact been reported. According to TV Asahi and Kyodo News, a man in his 20s was arrested on suspicion of opening an account online around April 2025 with the licenses of two people, including a man living in Gunma Prefecture, and defrauding a lender of 800,000 yen through a loan contract. Investigators believe he may have passed face authentication with an impersonation image or a suspicious app. This case is separate from the Times Car incident, and how the license images were obtained is not known here.

Changes the government is making#

In response to this kind of misuse, the government is revising remote identity verification. FSA material says that, given accounts opened with forged or altered ID documents being used for fraud, a policy was presented to consolidate remote identity verification, in principle, into public personal authentication with the My Number Card. On June 24, 2025, the enforcement regulation was amended so that methods with a high risk of impersonation through forged or altered documents will be abolished.

According to the guidance of JAFIC (the Japan Financial Intelligence Center under the National Police Agency), from April 1, 2027, opening an account and similar procedures will require reading IC chip data from the My Number Card or similar. The National Police Agency flyer says remote checks must send IC chip data from a driver’s license, My Number Card, or similar, and that images or copies of ID documents can in principle no longer be used. Individual institutions may start earlier than April 1, 2027.

In the materials for its July 2025 meeting with industry groups, the FSA asked each financial institution to respond as quickly as possible without waiting for the effective date. Until then, some institutions may keep using image-based methods.

The danger when images are tied to name and address#

A license image shows name, address, and date of birth. In its first report, the operator says the personal information that may have leaked could be misused for spoofed emails, phishing emails, and similar attacks. The Q&A urges caution about contacts that pose as the operator, financial institutions, mobile carriers, or public bodies to extract SMS authentication codes, IDs and passwords, account information, or PINs. “Fake police” scams are also covered, with a recommendation to consult the National Police Agency and an app that warns of nuisance calls.

Credit and loan contracts taken out in someone’s name are also a concern. In its page on the self-declaration, CIC lists “when your name may be misused by a third party” as one situation where the system helps.

What you can do now#

The operator’s guidance lists these steps.

1. Do not respond to emails, SMS, or calls that pose as the operator. Do not open links or attachments, and do not enter passwords or authentication codes
2. If you receive a suspicious contact, do not give out information on the spot. Check with the business through its official contact point
3. The operator never asks for passwords or SMS authentication codes by phone or email

In addition, there is a self-declaration with the credit bureaus. The credit bureaus CIC and JICC let you register information in your credit record that serves as a caution. Member companies see it when they check credit information while screening credit or loan applications.

Item	CIC	JICC
Name	Personal Declaration (本人申告)	Personal Declaration Comment (本人申告コメント)
Situation involving a license image	“When you sent an image of an ID document to a suspicious person or site”	“Preventing misuse of your name.” Examples include “I sent a driver’s license image”, where you still hold the original but the information has leaked
How to apply	Online or by mail	The person, age 15 or older. No agents
Fee	1,000 yen (tax included) online	700 yen (tax included) by smartphone app
Registration period	5 years from the registration date	5 years from the registration date

CIC states that each member company makes its own credit decisions and that it does not guarantee the effect of a declaration. CIC’s FAQ says the declaration does not promise to prevent misuse, and that CIC does not compensate for misuse. Because a declaration cannot completely prevent all unauthorized use, it is meant to be used together with other measures.

JICC’s description names “when information has leaked”, so it reads as a category that also covers a leak from a business. CIC’s category is worded for the case where the person sent the image. In another page, however, CIC explains that a declaration about unauthorized use of your name can reduce the risk of misuse when your personal information may have leaked. When a third party learns your personal information, credit or loan applications can be made without your consent.

What businesses can take from this#

Behind the leak reaching people who had left the service is the fact that the operator kept their information for seven years after withdrawal. This shows a need to decide what to keep, for what purpose, and for how many years, in a form that can be explained to users. Whether the retention in this case was appropriate under the law cannot be judged from the published information alone.

The shift toward reading IC chip data also gives businesses a reason to reconsider why they store images at all. That is each company’s decision.

What to watch for in later reports#

• The cause, the intrusion route, and measures to prevent recurrence
• The compensation policy
• Detailed guidance for members whose ID documents leaked

Official follow-ups appear in the Times Car news section. The wider picture is also summarized in security incidents in Japan in September.