Inside the Phishing Scandal Rocking Rakuten & SBI Securities

Rakuten Securities Inc., one of Japans leading online brokerage firms, has ramped up its identity verification measures after falling victim to a wave of fraudulent transactions. The incidents, which surfaced in March, were linked to phishing attacks that tricked customers into revealing sensitive login credentials.

The fraudulent activity involved the unauthorised sale of customers‘ stocks and investment trust funds. The proceeds were then used to purchase low-volume stocks in Chinese companies without the account holders’ consent. Rakuten Securities confirmed the transactions had not resulted from an internal data breach, suggesting that customer information remained secure on its servers. However, the company declined to disclose the number or extent of affected transactions, citing concerns over potential repeat offences.

Investigations indicate that phishing emails, mimicking official communication from Rakuten Securities, were at the heart of the scam. These emails urged recipients to confirm their account information for security purposes. Victims who clicked on the provided links were redirected to counterfeit websites designed to steal login details. Once compromised, their accounts were hijacked and manipulated.

The attackers typically sold off the victims existing assets and used the funds to buy Chinese stocks. While the motive behind choosing such stocks remains unclear, company officials suspect that the perpetrators are part of a larger scheme to artificially inflate prices and offload their holdings at a profit.

In response, Rakuten Securities introduced a new security feature on 23 March known as “risk-based authentication.” This mechanism prompts users to provide additional identity verification if they access their accounts using unfamiliar devices. Customers must also call a specific toll-free number from a phone registered with the firm to complete transactions. No prior arrangement is required for this verification process. The firm has also encouraged users to update their PINs as an added precaution.

SBI Securities Co., another prominent Japanese brokerage, has reported similar incidents, although on a significantly smaller scale. Like Rakuten, its customers were targeted by deceptive emails claiming their accounts had been temporarily suspended due to suspicious activity. The emails instructed users to re-enter their credentials to restore access, leading many to unwittingly disclose their private information.

SBI Securities has since decided to strengthen its security infrastructure. Previously, customers only had to undergo two-factor authentication when withdrawing over 500,000 yen (approximately $3,320). From 9 May onwards, this security measure will apply to all withdrawals, regardless of the amount.

Both firms are urging clients to remain vigilant, avoid clicking on unsolicited links, and refrain from entering personal data on suspicious websites. These events underscore a growing threat to online investors, with phishing scams becoming increasingly sophisticated and difficult to detect. As financial institutions bolster their defences, customer awareness remains the first line of protection against these digital threats.