The National Police Agency said fraudulent text messages that mimic au and SoftBank carrier billing portals spiked in September, luring users into approving third-party charges that appear on monthly mobile statements.
How the scam works
Victims receive SMS links claiming a payment failed or a loyalty point expires. The landing page copies carrier color schemes and login fields, then asks for credentials or one-time codes that criminals use to enroll the number in premium content subscriptions. Because charges ride the carrier bill, victims often notice them only when the monthly statement arrives.
Police urged users to open carrier apps directly rather than following links and to enable billing locks that require PIN approval for third-party purchases. The agency said reports climbed fastest among smartphone users over 60 who recently switched to unlimited data plans.
Carrier response
Mobile operators said they are filtering known phishing domains and displaying warnings when customers visit suspicious URLs on network DNS. SoftBank and KDDI-affiliated au both publish sample fraudulent messages so subscribers can compare wording.
Corporate IT departments are extending smishing training to employees who use personal phones for two-factor authentication on work accounts, a overlap criminals exploit when billing scams steal SMS codes.
Recovery steps
Victims should contact the carrier's fraud desk to dispute unauthorized charges and reset account passwords. Police accept cybercrime reports online, although recovery of funds is difficult once charges settle.
The Cabinet Cybersecurity Center has separately warned municipalities about fake e-tax messages, making October a month of dual phishing themes targeting both mobile wallets and government portals.
Consumer affairs centers in Osaka and Fukuoka reported parallel hotline spikes, suggesting the scam is national rather than Tokyo-centric. Counselors walk victims through carrier dispute forms that must be filed within contractual windows to maximize refund odds.
Android device makers said they will expand default SMS filtering in the next security patch, although criminals rotate domains faster than block lists update. iPhone users remain vulnerable to links opened inside mobile browsers that mimic carrier single sign-on.
School boards asked parents to disable carrier billing on children's lines entirely, a setting many families did not know existed until the NPA advisory circulated through municipal newsletters on Monday.
Regional banks pushed in-app alerts Tuesday that carrier billing differs from wire transfers, mirroring NPA templates so warnings stay consistent at smaller institutions.