Tokyo Metropolitan Police said its cybercrime division shut down a server cluster that hosted 890 cloned National Tax Agency login pages, part of a phishing wave timed to year-end adjustment season and the Sports Day travel week. Authorities attributed the takedown to coordinated work with hosting providers and did not release individual names in Friday’s bulletin.
How the pages worked
According to the bulletin, victims received SMS or messaging-app links promising tax refunds or “My Number confirmation” before holiday bonuses arrive. The pages asked for My Number card PINs and online banking credentials, then relayed data to backend scripts on offshore virtual machines. Investigators said the 890 URLs rotated daily to evade blocklists—a pattern consumer groups warned about after prior impersonation campaigns targeting Japan Post Bank and pension portals.
Legitimate e-Tax services live on government domains and do not request full card PINs through ad-hoc links. The National Tax Agency repeats that guidance each autumn; police echoed it with Sports Day-specific timing because travelers check phones at highway rest stops where rogue Wi-Fi captive portals also appear.
Enforcement steps
Metropolitan Police described the action as infrastructure dismantling: isolating IP ranges, preserving logs for mutual legal assistance requests, and notifying domestic carriers to sinkhole related domains. No arrest totals were published Friday; the public advisory focused on prevention. Companies whose brands were mimicked received takedown notices through industry groups.
JPCERT/CC and the National Police Agency have published parallel guidance on Keitaro-style phishing kits that let low-skill operators spin up hundreds of domains. Friday’s operation targeted one high-volume node, not the entire kit ecosystem.
What households should do
If you submitted credentials, call your bank’s loss-prevention hotline using the number on your card, not a callback from the message. Municipal offices can confirm whether real tax notices were mailed to your registered address. Sports Day road traffic will keep people on phones—pause before tapping links that claim urgent refunds.
Employers rolling out year-end adjustment portals should remind staff that HR systems never overlap with National Tax Agency login screens. IT desks saw ticket spikes last week when similar pages targeted corporate VPN credentials.
Broader context
Japan’s digital identity push increases convenience but concentrates risk in a few familiar interfaces. Police want the takedown to signal that bulk hosting of government clones will draw rapid technical response even during holiday weeks. It does not eliminate copycat pages; vigilance and two-channel verification remain the practical defense for households on the move.