The Outlier Lab

Case Study - Japan Brokerage Account Takeovers (2025)

In 2025, phishing-driven takeovers of Japanese online brokerage accounts were used to sell victims' holdings and buy thin stocks in ramp-and-dump schemes, prompting compensation and mandatory phishing-resistant MFA.

What happened

  • Access. Attackers obtained login IDs, passwords and trading PINs through convincing phishing sites and emails and through credential-stealing malware. Analysts also pointed to adversary-in-the-middle relays that capture session cookies. Japan's widespread use of browser-based trading rather than apps, together with OTP-by-email/SMS or password-only logins, made credentials enough to get in (Phishing and Credential Harvesting, Session Hijacking and Infostealers).
  • Monetization without withdrawal. Withdrawals usually go only to a verified bank account in the customer's name, so attackers didn't try to take cash out. Instead, they liquidated the victim's portfolio and used the cash, and in at least one reported case margin, to buy illiquid domestic, Chinese and US small caps. The attackers had positioned in those stocks beforehand and sold into the inflated price from accounts they controlled. One stock that normally traded about 194,000 shares a day traded 5.8 million on April 16, 2025. This is Ramp-and-Dump via Account Takeover, and it gets around Withdrawal and Payout Controls entirely.
  • Victim harm. Victims were left holding inflated positions that then collapsed. Reported individual losses ranged from about ¥640,000 to about ¥50 million. In one reported case, police declined a victim's complaint on the reasoning that the brokerage, not the customer, was the legal victim.
Diagram: Phishing site / infostealer, Login with stolen ID, password, PIN, Sell victim's holdings, Buy thin stocks (sometimes on margin), Attacker sells pre-positioned shares at inflated price, Victim left with collapsing position

Timeline

DateEvent
January–February 2025Low baseline: 69 and 34 unauthorized trades at 2 firms (FSA current data)
March 2025Wave starts: 935 trades at 5 firms, about ¥17.5B in sales
April 16–18, 2025Running total of 12 firms, about $350M in sales and $315M in purchases (as reported in April). FSA warning notes proceeds were used to buy small caps, including Chinese stocks. Some brokers block buys in targeted stocks. JSDA chair says a blanket refusal to compensate is unacceptable.
April 2025Monthly peak: 5,490 unauthorized logins and 3,033 trades at 10 firms, about ¥162.5B in sales. Figures reported at the time were lower (2,746 to 2,932 trades) because the FSA revises its data as cases come to light.
May 2, 2025JSDA announces that 10 major firms (including SBI, Rakuten, Nomura, Daiwa, SMBC Nikko, Mizuho, Matsui and Monex) will pay some compensation for unauthorized trades since January 2025, regardless of their terms, set case by case
May 20252,440 trades. 16 firms affected, the monthly high. FSA calls for mandatory MFA, passkeys, transaction limits and better detection.
June 2025Trades fall to 920
July–August 2025Second bump: 930 and 654 trades
July 25–29, 2025Rakuten details its compensation policy (amount set by circumstances, no percentage published). SBI announces 50% cash compensation plus a ¥10,000 payment to every victim, with about ¥8B expected cost.
September 26, 2025Matsui says it had paid a flat 50% and will move to case-by-case decisions for damage from September 29, 2025
October 2025FSA revises supervisory guidelines to require phishing-resistant MFA by end of June 2026
December 20252025 total: 17,717 unauthorized logins, 9,861 trades, about ¥394.9B in sales and ¥346.8B in purchases
January 2026FSA publishes incident status through December 2025 and asks JSDA to monitor guideline compliance
February–March 2026Fewer trades (171 and 121) but larger sales (about ¥11.5B and ¥15.9B), so value per incident rose
End of June 2026Phishing-resistant MFA deadline
July–September 2026Activity near zero: 5, 25 and 2 trades a month (FSA, October 9, 2026 update)

Mechanisms involved

Control gaps

GapWhy it mattered
Password, or password plus email/SMS OTPPhishing relays captured both (Passkeys and Phishing-Resistant Authentication)
Withdrawal controls treated as the main defenseAttackers never withdrew. The loss happened through trades (Trading Pattern Signals).
No step-up on out-of-character tradingFull liquidation followed by concentrated buys in illiquid names didn't trigger a challenge (Risk-Based Authentication and Step-Up)
No cross-account view of the same thin securityMany unrelated accounts buying the same stock on the same day (Entity Link Analysis, Transaction Monitoring)
Limited trading limits per accountMargin and full-portfolio orders were allowed without a cooling period (Velocity and Exposure Limits)

Detection and response

The firms' first response was blunt: blocking buy orders in targeted stocks and pausing some services. That was followed by mandatory MFA. Monthly trades fell from about 3,000 in April 2025 to about 900 in June as authentication tightened, then bumped back up in July and August before tailing off. Trades fell to single or low double digits a month after the June 2026 phishing-resistant MFA deadline. That is evidence that login hardening works, though the February–March 2026 rise in value per incident shows that the remaining attacks got bigger. The regulator required phishing-resistant MFA within about eight months and put the JSDA in charge of monitoring compliance.

Compensation was a collective industry decision with no common formula. The May 2025 JSDA agreement committed ten major firms to pay something regardless of their terms of service, with amounts set by the damage, how the customer handled credentials, and whether the firm had warned them. Within that, SBI and Matsui disclosed flat 50% coverage, Matsui later moved to case by case, and Rakuten did not publish a percentage. No firm had a legal obligation to pay.

Outcome

  • Financial: per current FSA data, about ¥394.9B in unauthorized sales and ¥346.8B in unauthorized purchases in 2025, and about ¥437B and ¥384B cumulatively through September 2026. The FSA says these are not customer losses. The widely cited "¥571B through June 2025" was an earlier figure that appears to combine sales and purchases. Partial compensation by firms, including SBI's ~¥8B provision.
  • Regulatory: revised supervisory guidelines requiring phishing-resistant MFA by end of June 2026, with JSDA monitoring. JSDA guideline on preventing unauthorized access under review.
  • Market: temporary buy restrictions on targeted securities, and a hit to confidence in retail investing just as Japan was expanding its NISA tax-advantaged accounts.

Lessons for practitioners

  1. Withdrawal controls aren't enough in brokerage. When cash can only leave to a verified bank account, attackers take value through the market instead. Score trades as well as payouts: full liquidation, first-time margin, concentrated buys in thin names (Trading Pattern Signals, Playbook - Ramp-and-Dump Members).
  2. Monitor the security as well as the account. The strongest signal was many unrelated accounts buying the same illiquid stock in a short window. Run a symbol-level cross-account monitor, and give a person the authority to restrict buys within hours (Graph Analytics, Fraud Incident Response).
  3. Plan the move to phishing-resistant authentication now. Regulators moved from "MFA" to "phishing-resistant MFA" in one step. US firms under Broker-Dealer Obligations (FINRA and SEC) should expect similar pressure (Passkeys and Phishing-Resistant Authentication).
  4. Decide your compensation policy before the incident. Firms that began with "case by case" faced public and regulatory pressure and settled on partial reimbursement. Model the liability and the reputational cost ahead of time (Loss Taxonomy and Attribution).
  5. The same pattern applies outside brokerage. Any platform where value can be moved inside the system to an attacker's benefit, such as marketplace purchases from a colluding seller or reward transfers, is open to this "convert without withdrawing" approach (Fraud Rings and Collusion, Online Marketplaces). Compare Case Study - DraftKings Credential Stuffing (2022), where cash-out ran through payout redirection.

Sources