GMO CLICK Securities: a customer account was logged into, its withdrawal account changed, and 1.49 million yen taken

On September 7, a third party logged into one customer's account, changed the bank account for withdrawals and took out 1.49 million yen. The receiving account had been opened fraudulently. [1] [2]

The company said it had found no leak of IDs or passwords from its own systems and no other withdrawals like this. [2]

Online changes of withdrawal accounts were suspended and replaced by paper forms sent to the registered address. Two-step authentication for online changes and withdrawals was planned, along with closer monitoring. [1] [3]