Notifications
Clear all
Topic starter
12/07/2026 12:27 pm
TL;DR: Japan’s digital policy roadmap is pushing My Number Card-based verification toward wider mobile use across iPhone and Android, with phased changes extending into 2028, according to Cybertrust Japan. The shift forces IAM and identity teams to treat mobile document verification as a governance and assurance problem, not just a convenience feature.
NHIMG editorial — based on content published by Cybertrust Japan: "iPhoneのマイナンバーカード"で今後の本人確認書類はどうなる？
By the numbers:
- An internal survey found that 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time.
- Only 5.7% of organisations have full visibility into their service accounts.
- Certificate expiry is the leading cause of outages for 45% of organisations.
Questions worth separating out
Q: How should organisations secure mobile identity verification without over-sharing personal data?
A: Use data minimisation, auditable consent, and strong binding between the presenting user, the device, and the relying party.
Q: Why does mobile document support create identity governance risk?
A: Because the same identity outcome can rely on different verification paths across platforms, which makes assurance harder to standardise.
Q: What breaks when identity proofing is weak?
A: Weak proofing lets the organisation issue credentials to the wrong person or entity, which means later access controls are protecting an assumption that was never verified.
Practitioner guidance
- Define platform-specific proofing policy Write separate acceptance rules for iPhone, Android, and legacy card workflows so identity proofing does not rely on a single assumed device path.
- Review fallback verification paths Document what happens when a preferred mobile verification method is unavailable, including who approves the exception and what evidence is required before account creation or recovery proceeds.
- Align document retirement with lifecycle controls Track when an identity document format, chip flow, or wallet-based method becomes deprecated and ensure downstream systems stop treating it as equivalent to current verified identity evidence.
What's in the full article
Cybertrust Japan's full blog post covers the implementation detail this post intentionally leaves for the source:
- A phased timeline for which mobile identity verification methods are expected to work on iPhone and Android.
- The document and wallet support implications behind My Number Card verification changes.
- The specific examples of identity documents and card formats that will need policy review as the rollout progresses.
- The practical support considerations for organisations that need to adapt onboarding and verification workflows.
👉 Read Cybertrust Japan's analysis of My Number Card changes for mobile identity verification →
iPhone My Number Card and identity verification: what changes now?
Explore further
12/07/2026 12:39 pm
Mobile identity assurance is becoming a policy problem before it is a technology problem. The article shows that support for My Number Card verification will expand through staged releases, which means the real control point is governance over when a method is considered trusted enough for use. IAM teams should read this as a reminder that assurance depends on acceptance policy, not just feature availability.
A few things that frame the scale:
- 71% of NHIs are not rotated within recommended time frames, increasing the risk of compromise over time, according to the Ultimate Guide to NHIs.
- Only 5.7% of organisations have full visibility into their service accounts, which shows how quickly governance breaks down when identity inventories are incomplete.
A question worth separating out:
Q: Who should own mobile identity verification policy?
A: Ownership should sit with identity and access governance, with input from security, compliance, and the teams running customer or employee onboarding. If the policy affects regulated identity proofing, the accountable group must also define how acceptance criteria, support exceptions, and downstream access decisions are reviewed and updated.
👉 Read our full editorial: iPhone My Number Card changes are reshaping identity verification
