Sony Confirms Flaw in Older FeliCa Chips Used for Japan's Transit, Payments and ID Cards

A security weakness in chips behind everyday transactions

Sony Corporation has acknowledged a security vulnerability in certain FeliCa contactless IC chips shipped before 2017, raising concerns about technology used in Japan's train passes, electronic payments and identification cards. As of August 29, 2025, the flaw has been confirmed in laboratory settings, but no cases of abuse have been detected.

A research group in Tokyo discovered the weakness and reported it in July 2025 through Japan's Information-technology Promotion Agency (IPA). Specific operations identified by the researchers could allow protected information on affected chips to be read or changed. Encryption keys, the secret information used to protect transactions, could also be stolen.

FeliCa chips have been shipped in more than 1.8 billion units since the technology's introduction. That reach helps explain the concern: the chips support services that people use to board trains, buy goods, enter workplaces and identify themselves at schools. The affected products are certain older physical cards, while Mobile FeliCa devices, including smartphones using Osaifu-Keitai mobile wallet services, are not affected.

Sony and major service providers say security also depends on the systems surrounding a card, including monitoring that can identify suspicious activity and block compromised cards. JR East, NTT Docomo, JCB and JR West have reassured customers about the safety of their services while working with Sony.

For passengers and shoppers, the immediate guidance is to follow announcements from the company operating their card or payment service. No immediate action is required for most consumers. Sony has not announced specific countermeasures, and a possible replacement of older cards would present a substantial practical challenge.

Where FeliCa is used and how it works

Sony introduced FeliCa in the late 1990s as a proprietary contactless smart card technology. It is widely used in Japan and several other Asian markets for payments and authentication, the process of checking whether a card or credential is genuine.

Suica and Pasmo use FeliCa for train and bus travel. Edy and Nanaco use it for electronic money. The technology also appears in employee and student identification cards and in passes that control entry to secure facilities. Its speed, reliability and security have helped make it a trusted part of Japan's cashless services and public infrastructure.

A FeliCa card communicates with a reader through radio-frequency identification (RFID). When someone taps a card, the chip and reader exchange encrypted information so the system can quickly check the card and approve a payment or entry. Encryption protects information by making it readable only through the appropriate secret keys.

Those keys are stored inside the chip and are supposed to remain inaccessible to outsiders. The vulnerability concerns that protection: if an attacker obtains the keys, information that should be protected could become accessible or open to alteration.

FeliCa is used in physical cards and in mobile devices, including smartphones with near field communication (NFC) capability. The distinction matters here because the disclosed weakness affects certain older physical cards, while Mobile FeliCa devices are outside its stated scope.

What researchers found in older chips

The Tokyo research group identified operations that could allow data on certain chips shipped before 2017 to be read or tampered with. Sony acknowledged the vulnerability in late August after inquiries from news organisations.

An attacker who extracted a card's encryption keys could potentially change a transit card's balance or validity, interfere with electronic payments, or forge an employee or student pass. For facilities that rely on those passes, the concern would be unauthorised entry. Cloning a card for fraudulent use is another possible consequence described in the disclosure.

The laboratory finding concerns the chip itself. Whether a changed or copied card can be used successfully also depends on the checks performed by the service accepting it. Sony says FeliCa service security rests on the wider system architecture as well as the chip.

Cybersecurity specialists have described the flaw as an extremely serious problem because the technology supports infrastructure used throughout daily life. The concern is both financial and operational: successful exploitation could affect payments, transport services or access to protected premises.

The discovery and public acknowledgment followed this sequence:

• July 2025: A research group in Tokyo reported the vulnerability through the IPA.
• Late August 2025: Sony publicly acknowledged the weakness after media inquiries.
• August 29, 2025: No abuse had been detected, and Sony and service providers were cooperating on their response.

Which cards and services are affected?

The vulnerability is limited to certain physical FeliCa cards using chips produced or shipped before 2017. The categories potentially involved include transit cards such as Suica and Pasmo, prepaid electronic money cards, and employee or student identification cards issued before 2017.

Mobile FeliCa devices are not affected. That includes smartphones using Osaifu-Keitai services. Modern FeliCa chips shipped after 2017 are also considered secure in relation to this vulnerability.

JR East, which operates Suica, has reassured users about its service. Other major partners issuing safety assurances include NTT Docomo, which operates the iD payment service; JCB, associated with QUICPay; and JR West. The companies are working with Sony to monitor the situation and strengthen security where needed.

The 1.8 billion figure describes cumulative FeliCa shipments since the technology was introduced. Sony has not given a count of affected cards still in circulation or announced a timetable for replacing them. For individual cardholders, the relevant advice therefore comes from the operator responsible for their particular service.

Why a chip flaw does not act alone

Sony's response places weight on security beyond the card. A transaction involves a chip, a reader and the operator's supporting systems. Those systems can monitor activity and identify cards that appear suspicious, giving operators another way to respond when a chip's protection is compromised.

NTT Docomo has pointed to routine monitoring of iD and its ability to investigate suspected fraud. A company spokesperson described that process:

We monitor the iD service daily and if we detect any fraudulent use, we will investigate it individually and take appropriate action.

Service operators can also block cards through their backend systems, the computers and software that support transactions behind the scenes. This provides a means of stopping a card even if someone has managed to obtain its encryption keys.

That assessment is reflected in the FeliCa security analysis, which describes the issue as largely theoretical and manageable through controls at the system level. Its explanation focuses on the ability to identify compromised cards:

Even if a card chip's keys are compromised, it is easy to identify and block such cards on the system backend.

Operators say their monitoring and fraud detection measures provide protection alongside the chip's own security. No known abuse has emerged so far. If attackers succeeded in exploiting the weakness on a large scale, however, transport disruption, fraudulent payments and unauthorised access could damage public trust and the reliability of services.

What an attack would involve

Smart cards contain small computer chips that store sensitive information and carry out cryptographic operations, the calculations used to protect and verify data. Older designs can become vulnerable as techniques for examining and attacking chips develop.

Two techniques discussed in this context are side-channel attacks and chip decapsulation. A side-channel attack seeks clues from a chip's behaviour while it operates. Decapsulation involves opening the chip's protective covering so its internal components can be examined. Both illustrate how physical hardware can become a target alongside software.

For the FeliCa weakness, the described attack would require physical access to a vulnerable card and specialised equipment to extract encryption keys and change data. An attacker could then try to add value without authorisation, forge access credentials or create a copy for fraudulent use.

Technical expertise and equipment are important practical limits. Such attacks are considered unlikely to be carried out at scale without detection. Operators' monitoring systems would also remain part of the transaction process, with the ability to investigate suspicious use and block cards.

The affected chips predate security improvements that became standard after their production. The issue illustrates the difficulty of protecting hardware that may remain in service for years while methods of attacking it continue to advance.

How Sony and the IPA are responding

The IPA helped coordinate disclosure through Japan's Information Security Early Warning Partnership Guideline. The process provided a route for the researchers' finding to reach the organisations responsible for assessing and responding to the risk.

Sony is cooperating with service providers and public institutions. Its guidance is for customers and other stakeholders to continue using FeliCa services according to information from their respective providers. Service operators are responsible for assessing how the chip issue interacts with their own transaction and security arrangements.

A fundamental response could require disabling affected older cards. Given FeliCa's extensive use across payments, transport and identification, such a step would create a large logistical task. Cardholders might eventually be asked to replace older cards as part of a wider security upgrade.

JR East and other partners have committed to working with Sony and the relevant authorities on potential threats. Their response combines reassurance to users with continued monitoring and security work.

Public concern and the debate over risk

Japanese and international coverage has brought attention to a technical weakness in an otherwise familiar everyday service. Some coverage has drawn criticism for presenting the danger too dramatically, while other discussion has focused on the practical conditions needed for an attack and the protections operated by service providers.

Technology commentators have said the vulnerability is not new to the security research community and have pointed to similar weaknesses found in other smart card systems around the world. Their argument centres on how a chip flaw interacts with the rest of a payment or access system.

Cybersecurity professionals have also cautioned against alarmism, describing the risk to consumers as low while providers maintain effective monitoring and response. An unnamed cybersecurity analyst expressed both the infrastructure concern and the importance of those safeguards:

This is an extremely serious problem that undermines trust in infrastructure, but with proper monitoring and response, the risk to everyday users remains low.

Japan's reliance on these cards makes communication especially important. Passengers need to know whether they can keep using a travel card, shoppers need confidence in payment services, and employers and schools need guidance about credentials used to enter their premises.

What cardholders should do now

Most consumers do not need to take immediate action. Service providers and card issuers are monitoring for suspicious activity and are expected to notify customers if they need to do anything. Users of Mobile FeliCa services and newer chips are outside the affected group.

People with older physical cards should follow official announcements from their card issuer or service provider, report suspicious activity or unauthorised transactions promptly, and replace a card if their provider advises it. A card issued before 2017 may eventually be included in a replacement programme if operators decide one is needed.

Sony's disclosure also brings attention to the work required to maintain infrastructure that remains in use for many years. Regular security audits and updates for older systems, clear communication among technology suppliers and operators, and investment in newer secure hardware and software are all part of that task.

Japan's expanding use of cashless services makes those responsibilities concrete. A security response must protect the money and access rights stored on cards while keeping trains, shops, schools and workplaces functioning. The current approach combines protection inside the chip with software controls, monitoring and the ability to respond through supporting systems.

Key Points

• Sony acknowledged a vulnerability in certain physical FeliCa chips shipped before 2017 after a Tokyo research group reported it through the IPA in July 2025.
• The flaw could expose encryption keys and allow card data to be read or changed, with potential risks to transit, payments and access credentials.
• FeliCa shipments exceed 1.8 billion units since introduction; the number of affected cards still in use has not been given.
• No abuse had been detected as of August 29, 2025. The vulnerability had been confirmed in laboratory settings.
• Mobile FeliCa devices are unaffected, and chips shipped after 2017 are considered secure in relation to this flaw.
• JR East, NTT Docomo, JCB and JR West have reassured users while cooperating with Sony. Monitoring systems can identify suspicious activity and block cards.
• Most users need take no immediate action. Follow the card provider's announcements, report suspicious transactions and replace older cards if advised.