Japan Post Bank: logins to the mijica debit card member site may have exposed 1,422 members, and fraudulent transfers took about 3.32 million yen from 54 of them

1. 2020-07-28

   In the periods July 28 to 30, August 1 to 4, August 14 to 20 and September 9 to 13, failed logins to the member site were higher than usual. [2]

2. 2020-08-08

   Fraudulent transfer orders were made from 4 accounts on the member site. [1]

3. 2020-09-06

   Fraudulent transfers were made from 7 accounts. [1]

4. 2020-09-11

   The bank lowered transfer amount and count limits. [1]

5. 2020-09-15

   Fraudulent transfers were made from 43 accounts. [1]

6. 2020-09-16 20:30

   At about this time, the card transfer function was stopped. [1]

7. 2020-10-02

   Late at night, a security review task force set up on September 25 found the periods with many failed logins in the access logs. [2]

8. 2020-10-04

   The bank said logins to 1,422 member accounts in those periods were automated, moving through pages abnormally fast, and may have been made by a third party. [2] [3]

9. 2020-10-05

   The bank said all 54 transfer victims were among the 1,422 members. [3]

10. 2020-11-09

    The bank published the results of its security review, held from September 24 to October 31. mijica had flaws in 14 of 22 items, including insufficient detection of unauthorized logins to the member site and weak authentication at transfer. [5] [6]

A total of 3,322,000 yen went from 54 cards to cards held by three fraudulent users. Reports of unrecognized email change notices and transactions revealed the fraud, and each receiving card was stopped the day after the transfer. The bank said it would repay everything. [1]

A transfer needed the member site ID and password plus the card ID printed on the back of the card. The bank said it was still looking into how this was done. [1]

Members whose accounts were logged into may have had their name, birth date, last 4 card digits and expiry date viewed. The member site locked after several wrong passwords, but once logged in, the last 5 digits of the card ID needed for a transfer could be tried any number of times. [2] [3]

A check of applications from July 1 to October 3 found cards used before they could have arrived by post. The bank stopped 3 cards that may have been created by someone other than the account holder. [4]

The bank said it would consider its strategy on the premise of keeping the current service, and was looking at moving only the functions to another service without the mijica name. The transfer feature and member site stayed suspended, while ATM deposits and withdrawals and debit card use continued. [5]