7pay

» see 7pay.co.jp as it lived, on the wayback machine

~ the eulogy ~

Seven Pay Co., Ltd. was incorporated on 14 June 2018 with 100 million yen of capital and a shareholder list that was entirely in the family. Seven & i Holdings took 40 percent, and the remaining 60 was divided between Seven Bank and Seven Financial Service. The product was announced on 4 April 2019: a barcode you showed at the register of a Seven-Eleven, in a country where the convenience store is closer to civic infrastructure and the company already had a contactless money card called nanaco with years of installed base behind it.

The two never properly met. You could not move a nanaco balance into 7pay, though you could push nanaco loyalty points across in the other direction. A company with the largest store network in Japan launched its second payment product unable to talk to its first.

7pay opened on 1 July 2019. On 2 July a user wrote in to say there were transactions on their account they did not recognize. An internal check on 3 July found the fraud was not isolated, and card top-ups were suspended the same day. On 4 July the company stopped cash loading at registers and at Seven Bank's ATMs, and at 18:05 it closed new registrations. What broke was not the barcode at the till, it was the 7iD account system sitting behind it.

A barcode at a Seven-Eleven till is not something I will ever scan, and the density of convenience stores that made 7pay worth building does not exist where I live. What crosses over is the failure itself, because a shared sign-on with no second factor is a decision available to anybody, in any market.

~ the dossier ~

~ two days ~

The escalation ran faster than the company's ability to describe it. On 8 July the Financial Services Agency issued a formal demand for a report under the Payment Services Act, and three days after that, login through external accounts was switched off. By 12 July the Metropolitan Police had arrested a part-time worker at a Seven-Eleven in Chiyoda ward on suspicion of theft, the third arrest connected to the case.

Then on 30 July, Seven & i force-reset the password of every 7iD holder. Not every 7pay user, every holder of the group's shared ID, about 16.5 million people. An app not yet a month old had reached the point where the cheapest available fix was to invalidate the credentials of sixteen and a half million customers at once. The tally published on 1 August put the damage at 808 accounts and 38,615,473 yen as of 31 July, and Seven & i committed to repaying all of it.

~ the press conference ~

At the emergency press conference on 4 July, the company said it had conducted repeated security reviews beforehand and that no vulnerabilities had been pointed out. Reporters in the room had already worked out that 7iD had neither two-step verification nor any notification when a password was changed. One of them asked the president about two-factor authentication, and he could not answer the question.

That exchange is why this one gets cited rather than merely remembered. The money was repaid inside a month and the sum was small against Seven & i's revenue. What could not be repaid was a televised minute in which the person running a national payment company was asked the most basic question in account security and had nothing to say.

~ the chime ~

The sound 7pay made when a payment went through was composed for it by Hyadain, the stage name of Kenichi Maeyamada, a well-known Japanese musician. The launch press release carried his note about it: because it is something you hear every day, he had wanted it simple and happy, and he hoped it would become a payment sound that stayed loved for a long time.

On 1 August, the day the closure was reported, he posted a stammered "never mind" about it, which J-CAST News thought worth an article of its own. The service ended at midnight on 30 September 2019. The accounts filed for the year to February 2020 recorded 1.631 billion yen of revenue against a net loss of 12.2 billion, and the company was finally wound up in 2025. Ninety-two days of trading took six years to finish burying.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »