Japan's National Police Agency said reported financial losses from SMS phishing more than doubled in September compared with August, driven by fake Japan Post Bank login pages that mimic the yucho direct app.
The tally covers cases police could verify through bank cooperation; NPA officials cautioned that many elderly victims never file reports. Losses cluster around pension deposit days and after holiday travel, when SMS notices about missed deliveries spike.
How the scam works
Victims receive texts claiming a Japan Post Bank account is locked after suspicious overseas access. Links lead to HTTPS sites with padlock icons and copied fonts from the real portal. After credentials are entered, callers impersonating bank fraud desks ask for one-time codes sent to the victim's phone.
Daiki Yamamoto, who covers security, said the September wave added My Number portal lures in parallel, using different copy but the same bulletproof hosting rotated every 48 hours. Japan Post Bank repeats that it never sends SMS links asking for passwords.
Bank and telco response
Major mobile carriers now label unscanned URLs in messages, but criminals split links across image attachments to evade filters. Japan Post Bank expanded weekend callback lines and pushed account freeze instructions through post-office ATMs.
The Financial Services Agency urged regional banks to adopt the same SMS keyword blocklist major cities use. Payment apps including PayPay separately warned merchants not to help customers install remote-access tools, a common escalation after bank credentials fail.
What households can do
NPA guidance: open banking apps by typing the official address or using saved bookmarks, never from texts. Report suspicious SMS to the 110 cyber hotline with screenshots before deleting messages.
With Keio group ransomware dominating headlines, police stress that SMiShing remains the larger yen loss category for households. September's doubling is a reminder that cloned public-brand pages still convert better than exotic malware for organized groups.
Enforcement outlook
Prefectural cyber units said they traced September domains to resellers in Southeast Asia, but takedown requests often arrive after mule accounts are drained. Banks are piloting delayed large transfers when login devices change, a friction step SMiShing callers try to talk victims around.
Post offices will run in-branch posters through October with QR codes that lead to official yucho pages, not login forms. NPA leaders want that physical channel because many victims still trust paper over push notifications.
Local read-through
Tokyo desks tracked the story through Monday's full trading and commute cycle, cross-checking official releases against market and household behavior rather than single social posts.
Ministries and companies are expected to update figures again after weekly closes; InfoHandle will revise if primary documents change.
For Japan-based readers, the practical question is what changes at counters, clinics, stadiums or portfolios this week—not just what was announced over the weekend.
Numbers and caveats
Where this report cites forecasts, market levels or loss tallies, those figures come from the attributed primary materials at publication time. Rounded yen amounts and index moves can differ slightly across data vendors because of timing and calculation methods.
Corporate guidance can shift at earnings briefings; police and ministry statistics are often labeled preliminary until year-end tables are compiled. Treat single-day market moves as context, not destiny.
When two agencies publish overlapping statistics, InfoHandle prefers the narrower definition cited in the headline and notes broader totals in body copy only if they change the stakes for readers.
Desk notes
Editors paired this story with Monday morning checks of primary sites, exchange data feeds and municipal portals rather than recycled wire copy.
Institution names, product labels and place references match the English source chips unless a Japanese official translation exists on the same page.
If you spot a material update after publication, use the site contact form; Japan edition posts carry Tokyo-dated timestamps aligned to the 6:00–6:59 window.