Securities Accounts: Measures to Prevent Account Hacking Are Urgently Needed

There has been a sharp increase in crimes in which accounts opened with securities companies are hacked by unknown persons and stocks are traded without the account holders’ knowledge. Individual investors must be feeling very uneasy.

With renewal of the Nippon Individual Savings Account (NISA) investment program in January last year, the base of individual investors has expanded. The securities industry must urgently implement measures to prevent accounts from being hacked. Law enforcement authorities must also devote their full efforts to cracking down on such crimes.

The Financial Services Agency has announced the extent of the damage caused by the online hacking of securities accounts and stock trades.

The number of cases of illegal trades was in the double digits in January and February but surged to 687 cases in March and 2,746 in April. A total of 3,505 cases were reported over the four-month period. This is a serious situation.

Incidents were confirmed at nine securities firms, including Rakuten Securities, Inc., SBI Securities Co. and Nomura Securities Co. The FSA said the amount of illegal trading in this way has exceeded ¥300 billion.

The method used to hack accounts involves first sending emails with titles such as “Urgent/Important” to investors. Recipients are directed to websites imitating those of the securities companies mentioned in the emails, where they are then prompted to enter their ID and password, which are then stolen.

Criminal groups use the stolen IDs and passwords to take control of legitimate securities accounts. They are believed to purchase large quantities of stocks in China and Japan that are typically traded at low prices and low trading volumes. After inflating the stock prices, they then sell the stocks to profit from the increased prices. This is a malicious criminal act.

Investigative authorities should identify the sources of the emails, trace the flow of funds obtained through illegal means and uncover the full extent of the crimes.

Preventive measures by securities companies are also crucial. They have reportedly implemented safety measures such as requiring investors to enter one-time passwords sent to their smartphones when logging into their accounts. It is essential to thoroughly inform investors of these measures.

Investors should also confirm their own protective measures. It is important not to open links displayed in scam emails, but to instead access legitimate websites.

Securities companies have said that they would compensate damages of accounts affected by the incident to a certain extent. While their terms and conditions previously stated that damages incurred by cases of unauthorized access would not be compensated, they have revised their policy in response to the expanded scope of the damages.

Investors are growing increasingly anxious, and swift responses are required.

It is surely necessary for each major securities company to make efforts to provide appropriate information, such as holding press conferences individually, regarding the spate of incidents and their response measures.

The Japan Securities Dealers Association, an industry group of securities firms, has begun discussions on measures to prevent illegal accesses. It should come up with effective countermeasures.

(From The Yomiuri Shimbun, May 10, 2025)