Photo/Illutration Rakuten Securities Inc. calls for customers to be on guard against fraudulent transactions on its website. (Captured from Rakuten Securities Inc.’s official website)

Rakuten Securities Inc. strengthened its identity authentication procedures from March 23 after its customers were victimized by fraudulent transactions, believed to be caught up in a phishing scam.

The company reported that customers’ stocks and investment trust funds were sold, and Chinese company stocks were purchased without the customers’ knowledge or consent.

“None of the information or assets of customers were leaked from our company. We will refrain from providing details of the damage, such as the number of fraudulent transactions, to prevent further damage,” a Rakuten Securities official told The Asahi Shimbun.

Rakuten Securities believes that phishing emails, designed to look as if they were sent from the company, triggered the fraudulent transactions.

The emails say, “To ensure the security of your account, please confirm,” and if customers click on the link, they are directed to a fake website to confirm their account information.

If customers enter their login IDs and passwords on the fake website, the registration information is stolen. The accounts are then taken over and used fraudulently.

According to Rakuten Securities, the typical fraudulent transactions involve perpetrators selling customers’ assets without their permission. Then, they purchase low volume stocks of Chinese companies using the funds they gained from selling the customers’ assets.

It is not known why such transactions are being made. However, the company official said, “It appears that fraudulent groups are manipulating stock prices and selling stocks that they hold at a higher price for a profit.”

Rakuten Securities instituted a new security countermeasure called “risk-based authentication” when customers make transactions starting from March 23.

When customers connect to the company’s website with different devices than they normally use, the website requires the customers to enter their login IDs, passwords and additional authentication information. 

Customers are also required to call a designated toll-free number from a phone number they registered with the company. No advance procedures are needed.

The company also recommends customers change their personal identification numbers.

SBI Securities Co. has also confirmed that similar fraudulent transactions involving Chinese companies’ stocks took place at its company.

However, it is believed that only a few occurred among SBI Securities customers, much fewer than the number among Rakuten Securities customers.

Customers of SBI Securities have also been receiving suspicious emails in succession.

The phishing method is the same that targeted Rakuten Securities.

The emails tell customers that the SBI’s system has detected abnormal transactions and temporarily suspended their account. Then, they require the customers to enter their login IDs and passwords to lift the suspension.

SBI Securities will strengthen its identity authentication procedures as part of its ongoing efforts against fraudulent transactions.

Customers are required to go through a two-factor authentication process where they receive emails containing an authentication code, in addition to traditional login procedures, when they withdraw money from their accounts.

Currently, the two-factor authentication procedure is required only when customers withdraw more than 500,000 yen ($3,320).

However, since the evening of May 9, the procedure will be required whenever customers withdraw funds regardless of the amount.

SBI Securities is calling on its users to remain alert and not to click on links shown in suspicious emails, and if they are connected to fake websites, not to enter passwords and other personal information.

Related News