Tokyo — The National Police Agency is warning that a September wave of SMS phishing, or SMiShing, is using fake Japan Post Bank login pages and My Number portal screens to harvest credentials and one-time passwords. The NPA advisory focuses on the method rather than a single suspect, and it tells recipients not to click links in unexpected text messages.
The messages vary, but the hook is familiar: an urgent notice about account suspension, unauthorized login, a delivery problem, or a My Number procedure that supposedly needs immediate confirmation. The link opens a page designed to look like a Japan Post Bank sign-in screen or a My Number portal prompt. The page then asks for a user ID, password, PIN, or authentication code. Once entered, those details can be used to access accounts or to complete identity fraud.
Why bank and My Number lures work
Japan Post Bank and the My Number system sit at the center of routine household administration. A text that appears to come from either one can feel like a bill, a refund, or a compliance notice rather than a fraud attempt. That is the opening the scammers need.
Japan Post Bank security guidance says the bank does not ask customers to disclose login credentials or one-time passwords through SMS. The My Number portal similarly tells users to access services by typing the official address, not by following unsolicited links.
What police have confirmed — and what they have not
The NPA warning lands in a broader run of SMS fraud that has targeted Japanese mobile users through bank, delivery, and government-service impersonation. Unlike a data breach, the September campaign appears to rely on social engineering: the victim is persuaded to hand over the credentials.
The agency has not named suspects in the public warning. That matters for clearance. Japanese police normally withhold suspect identities until arrest or indictment, and newsrooms should avoid filling that gap with speculation.
Investigators have not published a consolidated loss figure for this wave. The NPA role is to issue the national alert; prefectural police cyber crime units handle individual complaints. That division means local case numbers may surface before a national tally does.
The Japanese law questions
Under Japanese criminal law, phishing that induces a transfer or disclosure of property can be prosecuted as fraud under Penal Code Article 246. Unauthorized access to a computer or network can also trigger the Act on Prohibition of Unauthorized Computer Access. Those charges target the people who send the messages, run the fake sites, and withdraw the proceeds.
Civil liability is less automatic. Banks and service operators are expected to maintain reasonable security, but courts also examine whether a customer ignored clear warnings. For Japan Post Bank customers, the practical first step after a suspicious SMS is not to argue liability on the phone; it is to preserve the message, contact the bank through its official app or listed number, and report the incident to police.
Digital Agency officials have repeatedly said the My Number portal is not accessed through SMS links. If a message claims otherwise, the safest assumption is that it is fraudulent. Users who already entered details should change passwords, contact the relevant operator, and check for unauthorized transactions or identity use.
What to watch next
The NPA September warning is likely to be followed by updated counts from prefectural police and by bank advisories. The key numbers to watch are complaint volumes, confirmed unauthorized transfers, and whether the same infrastructure appears in both Japan Post Bank and My Number lures. Until those numbers are published, the confirmed story is the method: SMS messages, fake login pages, and credentials taken directly from users.
For households, the NPA advice is narrow and practical. Do not click. Do not enter a password or one-time code from a text link. Use the official app or type the official domain. If the message is real, the service will still be there through the normal channel.