Financial Services Agency Warns Users of Suspicious Emails, Encourages Use of Multi-Factor Authentication

Key Points of This Article

• The Financial Services Agency recommends using passkeys as a phishing countermeasure
• The government has decided on an emergency response package

Call for Individual Action

On the 6th, the Financial Services Agency urged users of financial institutions to be cautious of suspicious emails impersonating legitimate businesses and government agencies. There have been a series of leaks of customer information due to unauthorized access, and there is a possibility that sophisticated emails impersonating real businesses and government agencies may increase by misusing leaked information.

The Financial Services Agency explained that unauthorized access to customer service and business systems available on the internet continues. They requested the following actions from users of financial institutions:

• Do not easily click on links in emails
• Do not reuse passwords
• Use phishing-resistant multi-factor authentication
• If you receive notifications of transactions you do not recognize, promptly contact the financial institution involved

Due to the increase in fraudulent remittances and transactions caused by phishing impersonating financial institutions, the Financial Services Agency is collaborating with financial institutions and the National Police Agency to raise awareness through flyers and videos. They are also advocating for the use of phishing-resistant multi-factor authentication.

The promotional flyers indicate that even emails containing the names of financial institutions may be fraudulent, urging users to verify the sender's email address and the links provided. Since fake websites can be so sophisticated that they are indistinguishable from the real ones, it is effective to bookmark the official websites of financial institutions and install official apps from legitimate app stores.

Moreover, the Financial Services Agency recommends authentication using "passkeys," stating that traditional password measures alone cannot completely prevent financial crimes. Passkeys allow login through biometric authentication such as fingerprints or facial recognition, or PIN codes.

They also introduced authentication using PKI (Public Key Infrastructure) with a pair of public and private keys. This system enhances the reliability of identity verification by having trusted third parties, such as Certificate Authorities (CAs), issue electronic certificates that prove the relationship between the public key and its owner.

On the other hand, it was pointed out that multi-factor authentication using one-time passwords received via email or SMS could be bypassed through real-time phishing, man-in-the-middle attacks, or malware information theft. They called for a transition to authentication methods that are resistant to phishing, such as passkeys or PKI.

The Financial Services Agency is revising supervisory guidelines and administrative guidelines to include the introduction of phishing-resistant multi-factor authentication. They are promoting awareness among users across public and private sectors and the financial industry.

Government Also Decides on Emergency Response Package

This alert comes in response to the "Cybersecurity Emergency Response Package" decided by the government on the same day. Following a series of cyberattacks leading to information leaks, it was compiled at the second meeting of relevant ministers on cybersecurity held at the Prime Minister's Office.

The government positions this package as a starting point for transitioning to a cybersecurity system suitable for the AI era. To strengthen responses to cyberattacks, approximately 10 billion yen in contingency funds has also been allocated.

In the case of damage, many instances involved neglect of known vulnerabilities, improper website configurations, and insufficient security measures during development, indicating that basic measures by organizations and contractors were inadequate. They emphasized that such weaknesses have become susceptible to exploitation on a large scale in a short time due to advancements in AI, stating that this is a challenge that society as a whole must address.

Ultimately, they aim for a society that ensures "the world's highest level of cyber resilience."

The package consists of the following four pillars:

• Thorough implementation of basic security measures utilizing AI
• Collection and aggregation of attack information, and strengthening of investigation and analysis systems
• Strategic response to cyberattacks
• Strengthening support for victims and measures to prevent the expansion of damage

As a specific measure, a "Top Gun Talent Team" composed of highly specialized personnel will be established within the Information-Technology Promotion Agency (IPA) to conduct vulnerability verification and penetration testing (simulated intrusion tests) using AI. A system will also be established to collect and analyze attack information from companies and security service providers, centered around the National Cyber Coordination Office.

To ensure that organizations and individuals affected by damage do not feel isolated, consultation desks will also be set up. For businesses, dedicated police contact points for corporate victims, free consultations from the IPA, and sector-specific contact points from relevant ministries will be established. For individuals, the Consumer Affairs Center (188) will serve as an entry point, and a contact point for those affected by data leaks will be provided on the Prime Minister's Office website.

The National Cyber Coordination Office will share information about attack methods with each contact point, ensuring that support can be accessed regardless of where individuals seek help.

The "Cyber Response Special Site" opened on October 30 consolidates consultation desks and alerts. Accurate information will be disseminated in collaboration with relevant ministries to counter false or misleading information.