Japan’s Cabinet Cybersecurity Center issued a weekend alert documenting a surge in phishing pages that mimic municipal e-Tax password resets, steering small-business owners toward fake Digital Agency login portals that harvest My Number-linked credentials. Daiki Yamamoto’s security desk says the campaign rides autumn filing deadlines and confusion over which ministry operates which portal—tax, pension, and local residency systems all use similar blue-and-white branding in legitimate sites.
How the lure works
Attackers email sole proprietors and family companies claiming that e-Tax passwords expired or that consumption-tax refunds require immediate reauthentication. Links resolve to typosquatted domains with TLS certificates that look valid on mobile screens. Victims enter corporate numbers and personal IDs before being redirected to the real government site, masking the theft until fraudulent filings or bank account changes appear.
Some kits copy prefectural logos from open data packs; others use generic municipal seals to imply city-hall origin. The Cybersecurity Center’s notice includes checksums of known bad domains and asks ISPs to sinkhole repeat offenders.
Why SMEs are targeted
Japan’s invoice system and qualified invoice rules increased online tax traffic among shops that previously filed on paper. Many lack dedicated IT staff and rely on accountants who forward government-looking messages without verifying headers. With flu-season absenteeism straining back offices, phishing success rates rise when assistants cover for sick colleagues.
My Number credentials unlock multiple services; compromise can cascade into pension and health-insurance portals even when tax accounts are recovered quickly.
Defensive steps the center recommends
Businesses should bookmark official go.jp URLs instead of clicking email links, enable FIDO2 keys where agencies support them, and segregate duties so one person cannot change bank details and approve filings alone. Managed service providers must patch remote-access tools—attackers pair phishing with VPN exploits on weekends when SOCs run skeleton crews.
Accounting associations circulated template warnings to clients on Sunday, urging verification calls before any “urgent reset.”
Law-enforcement context
The National Police Agency’s cyber division has prioritised business-email compromise after prior waves impersonated banks and logistics firms. This municipal-themed variant is newer but follows the same monetisation path: sell credentials, attempt refund fraud, or deploy ransomware after remote access.
Cross-border hosting complicates takedowns; the alert asks domestic providers to accelerate abuse tickets when domains mimic kanji homographs.
What changes for filing season
Tax agents expect more in-person identity checks for first-time digital enrolments. Digital Agency teams stress that password resets never arrive from consumer webmail domains or regional ISP addresses. Multi-factor authentication remains optional on some legacy flows—a gap policymakers may close after incident tallies rise.
Accountant and MSP playbooks
Major accounting networks issued template client alerts on Sunday urging two-person approval for any bank-detail change on e-Tax profiles. Managed service providers raised monitoring rules for newly registered domains containing prefecture names combined with tax keywords—a cheap heuristic that caught several weekend registrations before victims clicked.
Regional banks reminded business customers that legitimate password resets flow through bookmarked portals, never through SMS links promising same-day refunds.
Corporate training cadence
Large employers scheduled Monday-morning security briefings for finance teams that handle consumption-tax filings, walking through sample phishing headers and spoofed sender domains collected over the weekend. IT vendors reported a spike in orders for hardware security keys compatible with government identity services, though backlogs remain for certain USB-A models still common in legacy back offices.
Chamber of commerce chapters in Osaka and Nagoya distributed printable checklists for shop owners who file through accounting software bundles, reminding them that legitimate agencies never request wire transfers to personal accounts for “verification deposits.”
Telecom carriers said they blocked several thousand SMS bursts over 48 hours that used rotating sender IDs imitating prefectural tax offices.
Bottom line
Fake municipal e-Tax reset pages are harvesting small-business credentials ahead of autumn filings. Bookmark official portals, verify out-of-band, and treat urgent password emails as hostile until proven otherwise—the Cabinet Cybersecurity Center’s spike tally is a leading indicator, not a post-mortem.