According to an embodiment, the IC card includes a communication unit, a verification rate acquisition unit, a setting unit, a reception processing unit, and a determination unit. The communication unit transmits and receives data to and from an external device. The verification rate acquisition unit acquires a verification rate of biometric information. The setting unit selects a security level corresponding to the verification rate from a plurality of security levels each indicating an executable command, and sets the selected security level as the current security level. The reception processing unit receives a command through the communication unit. The determination unit determines whether or not the received command is executable on the basis of the current security level.