Sumitomo Mitsui Trust Bank (SuMiTB), Japan’s largest trust bank, is shifting its mobile banking users to cloud-based FIDO authentication through a deployment with SCSK and OneSpan, in a move aimed at reducing account takeover and phishing-related fraud. The project, announced by OneSpan, is described as the first use of OneSpan’s cloud-based FIDO authentication solution for mobile banking in Japan, extending the company’s experience with on-premises FIDO deployments in the market.
SuMiTB is adopting OneSpan Cloud Authentication as the foundation for a FIDO-based, phishing-resistant security model that will ultimately support both login and transaction-level authentication inside its mobile banking channel. The shift aligns with rising regulatory pressure in Japan to strengthen consumer authentication. OneSpan cites Financial Services Agency (FSA) figures that put 2025 account takeover losses at roughly 690 billion yen and notes that the FSA has proposed amendments to supervisory guidelines that would make phishing-resistant authentication mandatory for financial institutions.
The collaboration positions SCSK as the integration partner for SuMiTB’s deployment, bringing local systems expertise and IT services capabilities, while OneSpan provides the FIDO authentication layer and broader multi-factor portfolio. The bank is expected to use FIDO not only to harden login flows but also to bind high-risk transactions to strong cryptographic authentication, with the goal of limiting impersonation and man-in-the-middle risk in mobile channels.
For OneSpan, the project reinforces its strategy of offering a mix of hardware authenticators, mobile authentication, and cloud-based FIDO services to banks that are migrating away from legacy password or OTP-based systems. The company frames the deployment as an example of how institutions can meet stricter regulatory expectations while modernizing user experience and scaling to large consumer populations.
As Japan’s banking sector responds to both fraud trends and evolving FSA guidance, SuMiTB’s move to a cloud FIDO platform will be closely watched as a reference implementation for other institutions looking to combine phishing-resistant authentication with transaction signing and mobile app security controls.
—
By the ID Tech Editorial Team
