Japan Pension Service postponed scheduled overnight maintenance on Nenkin Net after Nagano Prefectural Police warned that mirrored login pages copying the official pension portal had appeared in local phishing reports, the agency told subscribers in an urgent notice on October 16, 2026. The delay keeps the production certificate path stable while authorities trace domains that mimicked the familiar blue login screen.
What residents reported in Nagano
According to the police cyber-crime prevention desk, several residents received SMS messages claiming a pension premium deadline was imminent and linking to a site that visually cloned Nenkin Net’s user-ID field. The fake pages even copied the layout of the agency’s electronic-service banners, but hosted on domains one character off from legitimate government hosts.
Nagano’s advisory fits a national pattern Japan Pension Service has documented since February 2025: impersonation calls, forged emails, and fake social accounts that borrow the agency’s logo art. The local twist was the fidelity of the login mirror—enough that users who usually type credentials from muscle memory could not spot the mismatch until after submission.
Why JPS delayed maintenance
Routine maintenance swaps load balancers and renews TLS certificates on the idpass-net subdomain cluster. Doing that during an active phishing wave risks sending confused users toward whichever clone ranks highest in search ads. By slipping the window, JPS keeps bookmarked URLs and certificate prompts aligned with the single official host documented on its phishing guidance page.
The agency reiterated that it never asks for user IDs or passwords by email or SMS, mirroring language Nagano police use in their generic phishing bulletins. Maintenance will resume once law-enforcement partners publish takedown outcomes; JPS did not publish a new date in the October 16 alert.
How to verify the real portal
On desktop browsers, Japan Pension Service instructs users to click the padlock icon and confirm the server certificate is issued to www3.idpass-net.nenkin.go.jp. Android and iPhone flows differ by vendor, but the expected hostname is the same. Users who arrive via SMS should instead open a saved bookmark or open nenkin.go.jp directly without clicking the message link.
Digital Agency warnings on Mynaportal impersonation show the same tactic—callers posing as pension staff who steer victims to fake apps. Combining pension credentials with My Number portals is especially dangerous because both gates touch benefit payments.
Why Nagano reports matter nationally
Rural prefectures see the same SMS lures as Tokyo, but fewer walk-in help desks mean victims discover fraud only after premium debits look wrong. Nagano police used the October cluster to push residents toward bookmarked logins before year-end premium notices arrive in the mail—a season when pension-themed scams historically spike.
Practical steps for households
If you already entered credentials on a suspicious page, call Japan Pension Service using the number on your pension handbook—not any number on the fake site—and ask to freeze online access until passwords are reset. Nagano police ask residents to preserve screenshots and forward them to the cyber reporting form linked on the prefecture’s phishing page.
Enable any one-time password option your bank offers for unrelated accounts; police guidance notes that stolen pension IDs often get tested against financial logins in the same evening.
Agency liability and next moves
Japan Pension Service is not legally liable for individual phishing losses if credentials were volunteered, but reputational pressure rises when mirrors appear during maintenance season. Watch for a rescheduled maintenance bulletin on nenkin.go.jp and for Nagano police to update their case tally once domains are seized.
Municipal offices in Nagano posted paper notices directing elderly residents to call the pension hotline rather than follow SMS links, complementing the online alert. Japan Pension Service linked the postponement notice on its main warnings page. Local banks in Nagano echoed the certificate check in branch posters.
Until then, the only login page that matters is the one whose certificate names idpass-net.nenkin.go.jp—everything else is someone else’s mirror.