Japan Post Bank: money was taken from accounts through 6 linked payment services, with about 380 reported cases since 2017

1. 2020-09-15

   The Minister of Internal Affairs said at a press conference that 6 of the 12 payment services linked to Japan Post Bank, including docomo Koza, had losses. [1]

2. 2020-09-16

   The bank said it would stop new links and top-ups for the 10 services that did not use two-factor authentication when linking. [2]

3. 2020-09-17

   At a press conference, the bank reported 109 cases worth 18,111,000 yen at the 6 services. [3]

4. 2020-09-24

   The bank said reports since July 2017 totaled about 380 cases and about 60 million yen, and promised full repayment. It warned the about 5.5 million customers who had linked the 10 suspended services, and planned to call the holders of about 600 accounts of special concern. [4]

5. 2020-10-03

   Based on its review, the bank finished repaying 210 cases worth 49.4 million yen. 173 cases worth 11.91 million yen were left out because the payment firms judged them to be use by the holders or their families. [6]

The bank did not say whether some accounts were hit through more than one service. [3]

About 60 more cases worth 2.2 million yen were reported from September 23. The bank wrote by letter or mail to about 5.5 million customers registered with the 10 suspended services, asking them to check for registrations or payments they did not recognize. [5]

Identity checks for linking differed by contract, and some services did not use two-factor authentication. The fraud used personal details and PINs, but it was not made clear whether these came from phishing or another method. Of about 150 reports received through 2019, only about a third had a repayment decision. [2] [4]

Around the same time, fraudulent transfers with the Japan Post Bank: logins to the mijica debit card member site may have exposed 1,422 members, and fraudulent transfers took about 3.32 million yen from 54 of them debit card came to light, as did fake accounts at the bank used to receive money in SBI Securities: intruders got into 6 customer accounts, sold their securities and withdrew 98.64 million yen to fake bank accounts. [4]