#Japan #Tokyo #Phishing #QR Code #PayPay

Increase in QR Code Payment Scams

In May 2023, there has been a notable increase in fraudulent websites exploiting QR code payment systems. Unlike traditional phishing scams aimed at stealing user IDs and passwords, this new method directs users to payment screens, tricking them into transferring money directly. Scams often employ messages such as "You have unpaid taxes with e-Tax" to coerce victims into making payments.

Once a payment has been confirmed, recovering funds becomes extremely challenging as only the issuer of the QR code has the authority to cancel the transaction. Users are advised to take caution when receiving suspicious messages or encountering unknown websites requesting payment. It's essential to verify the situation through official websites or applications instead of hastily proceeding with transactions.

Beware of Points Reward Scams

Between May and June, scams masquerading as point exchange or reward services have surged. Fraudsters have been utilizing brands such as JRE POINT, Rakuten Points, V Points, and d Points to exploit users by stealing login credentials and personal information. Instead of using fear tactics as seen in previous phishing scams, these new scams appeal to users' sense of benefit, encouraging them to log in with offers of free points.

As many companies routinely run point reward campaigns, the risk of falling for these scams increases due to diminished vigilance when receiving emails or SMS announcements. Users are urged to avoid clicking on links from suspicious messages and to confirm points or rewards through official channels.

Phishing Sites Ranking

May saw a significant number of phishing sites impersonating PayPay. Alongside attempts to steal user login information, scams offering point rewards were also prevalent. A related observation is the rise of phishing sites disguised as credit card services.

Breakdown of Phishing Site Categories

In May, the proportion of phishing sites posing as credit card services increased, while those related to securities decreased, particularly due to fewer reports regarding Monex Securities fraud.

Key Points for Preventing Phishing Fraud

1. Verify URLs: Always confirm that URLs from emails or SMS are legitimate by using bookmarks or web searches to access official sites. Services that diagnose suspicious websites can also be beneficial.
2. Beware of Requests for Personal Information: Legitimate companies will never request personal or credit card details through email or SMS. Always exercise caution if prompted to enter sensitive data.
3. Avoid Reusing Login Credentials: Using identical login IDs and passwords across various platforms increases the risk of widespread unauthorized use if one site is breached. It is advisable to maintain unique credentials for different services.
4. Implement Security Software: With the ever-evolving tactics of fraudsters, it's crucial to have active security software capable of issuing alerts when accessing dubious sites.

Free Diagnostic Tools for Fraudulent Sites

For those wishing to assess the safety of a suspicious site, several free services, like the "Scam Site Checker," can be utilized. This tool leverages blacklists from relevant authorities to verify if a URL has been reported as fraudulent.

Site URL: Scam Site Checker

Professor Tatsuya Mori's Insights

One notable takeaway from this month's report is the high incidence of PayPay impersonation in phishing attempts. The shift towards schemes where the user is compelled to initiate payments marks a significant evolution from traditional phishing strategies designed to steal credentials. A report from Tobira Systems indicated that such scams involving PayPay have increased by over 22 times compared to February of this year.

Moreover, as the summer travel season approaches, it is anticipated that scams impersonating railway and airline services will rise. The notable positioning of えきねっと in the rankings may be indicative of these new threats. Users are urged to verify payment and login requests directly through official applications or bookmarks to mitigate risks, especially as recovery from fraudulent transactions can be exceedingly difficult. A little caution can go a long way in safeguarding one’s finances.