NTT DOCOMO: criminals linked other people's bank accounts to docomo Koza wallets and drained deposits at 11 banks

1. 2020-09-10

   DOCOMO stopped new bank account links. By September 9, 34 cases and about 10 million yen in losses had been confirmed. [1]

2. 2020-09-11

   DOCOMO reported 66 cases at 11 financial institutions, about 18.21 million yen, as of September 10, and said it would repay everything with the banks. [2]

3. 2020-09-14

   The count rose to 120 cases, about 25.42 million yen; 119 had happened between October 2019 and the September 10 stop. Top-ups from 22 financial institutions, including those hit, were halted. [3]

4. 2020-09-27

   Reported cases reached 219, 28.48 million yen. [5]

5. 2020-10-29

   DOCOMO finished repaying the 128 confirmed cases, 28.85 million yen. Reports had briefly reached about 250, but more than half turned out to be the holders' own use. [6]

Anyone could open docomo Koza without a DOCOMO phone contract. Linking a bank account doubled as the identity check, so an account number, PIN and a few details were enough. The attackers used details obtained elsewhere to link victims' accounts to wallets in the victims' names. DOCOMO said the links were targeted, not mass attempts. [1] [2] [3]

A similar case had happened in May 2019, after which DOCOMO lowered transfer limits. DOCOMO admitted its identity checks were weak, apologized, and said it would add online identity verification. [2]

Around the same time, losses were also found at other payment services linked to bank accounts, such as Japan Post Bank: money was taken from accounts through 6 linked payment services, with about 380 reported cases since 2017.