Multi-factor use is being banned for securities logins in Japan

At a glance

What this is: This is a policy and security analysis of Japan’s securities-account login changes, showing that multi-factor authentication alone does not stop intermediary attacks when the authentication method remains phishable.

Why it matters: It matters because IAM teams, PAM teams, and financial security leads need to distinguish between adding MFA and removing phishing exposure from the login path, especially where account takeover leads directly to fraudulent trading.

By the numbers:

• The monthly number of unauthorised securities transactions peaked at 5,424 in April 2025.

👉 Read Cybertrust Japan’s analysis of phishing-resistant login requirements for securities accounts

Context

Japan’s securities account security posture is shifting because phishing and intermediary attacks can capture both login credentials and session material, making traditional password plus one-time code patterns insufficient for high-risk transactions. In this case, the governance question is not whether multi-factor authentication exists, but whether the authentication method is resistant to interception and replay.

The article explains that Japanese regulators and industry bodies are pushing securities firms toward phishing-resistant authentication, including FIDO2-based approaches, because attack methods such as adversary-in-the-middle interception can defeat ordinary MFA. For identity programmes, this is a human IAM issue with direct downstream fraud impact, not just a customer convenience problem.

Key questions

Q: What breaks when securities firms rely on phishable MFA for high-risk accounts?

A: Phishable MFA still allows an attacker to intercept the login ceremony, steal session material, and reuse it immediately. In securities environments that means account access can translate directly into trading abuse, not just a login event. The control fails because it protects against password theft, but not against real-time interception of the authentication flow.

Q: Why do phishing-resistant logins matter more for financial accounts than for ordinary consumer services?

A: Financial accounts have immediate monetary consequence, so a successful login can create loss before the user or provider can react. Phishing-resistant authentication reduces the chance that an attacker can replay stolen credentials from a different location or context. That is why assurance strength matters more where the account can move money or alter payout details.

Q: What do security teams get wrong about multi-factor authentication in browser-based login flows?

A: They often assume MFA stops account takeover by itself. In browser-based flows, an adversary-in-the-middle can capture the session after the user completes the prompt, so the attacker never needs to defeat the factor directly. The practical mistake is measuring MFA presence instead of whether the method resists interception and replay.

Q: Who is accountable when account takeover fraud causes downstream losses?

A: Accountability sits with the teams that own authentication, session management, fraud detection, and incident response together. If an organisation treats account takeover as only a user problem or only a security problem, it will miss the handoff points where abuse becomes loss. Frameworks such as NIST CSF 2.0 and Zero Trust help define shared responsibility.

Technical breakdown

Why phishable MFA fails against intermediary attacks

Phishable MFA still depends on a shared authentication conversation that an attacker can intercept, relay, or reuse. In an adversary-in-the-middle attack, the user believes they are authenticating to the real site, but the attacker sits between the browser and the service, capturing session cookies, one-time codes, or password material. That means the second factor reduces risk compared with passwords alone, but does not eliminate real-time credential theft. For securities access, the danger is especially acute because successful login can immediately lead to trading, withdrawal, or account-change abuse.

Practical implication: treat phishable MFA as an improvement, not a control end state, for brokerage and investment logins.

What phishing-resistant authentication changes

Phishing-resistant authentication binds the login ceremony to the legitimate relying party, so stolen secrets are far less reusable off-site. FIDO2 and certificate-based approaches reduce the value of interception because the proof of possession is tied to the specific service and cannot be replayed in a separate context. In regulated customer identity, that changes the threat model from password theft to device- or key-bound trust. It also reduces the window in which a browser session can be hijacked after login, which matters when financial actions can be executed immediately after authentication.

Practical implication: prioritise phishing-resistant methods for any account that can move money, change settlement details, or alter contact information.

Why mandatory rollout is a governance problem, not only a technology problem

The article shows that regulators can require a class of authentication method, but each firm still has to decide how to phase migration, what exceptions to allow, and how to support customers who cannot enrol immediately. That is an IAM governance issue because access policy, assurance strength, and customer recovery flows must all align. A weak fallback path can silently reintroduce the same risk the stronger method was meant to remove. In other words, the control only works if the exception model is tighter than the main path.

Practical implication: design enrolment, recovery, and exception handling together, otherwise the weakest path becomes the default attack surface.

Threat narrative

Attacker objective: The attacker’s objective is to turn account access into direct financial gain through fraudulent securities transactions.

1. Entry occurs when an attacker uses phishing, intermediary interception, or another deceptive login path to capture credentials or session artefacts.
2. Escalation occurs when the attacker reuses the stolen authentication material to enter the securities account and reach trading functions.
3. Impact occurs when the compromised session is used for unauthorised trading, transfer manipulation, or account-control changes at scale.

Breaches seen in the wild

• New York Times breach — New York Times source code and credentials exposed via GitHub.
• MongoBleed breach — MongoBleed exposed secrets across 87K MongoDB servers.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phishable MFA is no longer an adequate assurance model for high-value consumer IAM. The problem is not authentication presence but authentication resistance. When an intermediary can steal the login flow, the control that looked strong on paper still leaves the account open to real-time abuse, especially where access can trigger immediate financial actions. Practitioners should treat phishing resistance as the real policy boundary, not MFA adoption alone.

Multi-factor login rules are becoming a governance issue, not just a security feature choice. The article shows regulators moving from recommendation to mandate because the residual risk is now material and measurable. That changes the operating model for IAM and compliance teams: customer authentication strength, account recovery, and exception handling must be governed as one system. Practitioners should expect enforcement to focus on whether the weakest path undermines the intended assurance level.

Account takeover in securities is a lifecycle failure as much as an authentication failure. Once an attacker gets in, the rest of the chain depends on how quickly the firm can detect anomalous trading, freeze activity, and invalidate sessions. That links human IAM, fraud controls, and response workflows into a single control plane. Practitioners should align login assurance with post-authentication containment, or the identity programme will still absorb the fraud loss.

Browser-mediated identity is the weak point that controls must now be designed around. AiTM-style attacks exploit the gap between user intent and service trust, which means the browser can no longer be assumed to be a neutral conduit. That matters for any programme that still treats MFA prompts as the main trust boundary. Practitioners should re-evaluate which access paths depend on browser-mediated proof and which can move to stronger authenticators.

From our research:

• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to the Ultimate Guide to NHIs.
• 79% of organisations have experienced secrets leaks, and 77% of those incidents resulted in tangible damage, according to the Ultimate Guide to NHIs.
• For the broader breach pattern behind credential theft and session abuse, see The 52 NHI breaches Report for real-world root causes and containment lessons.

What this signals

Phishing resistance is becoming the baseline for regulated identity programmes. The securities sector is showing where consumer IAM is heading next: not every login needs the same assurance, but high-risk journeys increasingly do. Teams that still treat MFA as a checkbox will find that regulatory expectations, fraud pressure, and user session risk are converging on the same control boundary. The question is no longer whether MFA exists, but whether the method survives interception.

Browser-mediated trust is now a governance problem for IAM and fraud teams together. Account compromise in financial services increasingly depends on session theft rather than simple password guessing, which means the response must include session invalidation, transaction controls, and recovery design. This is where identity lifecycle and fraud response meet in the same operating model.

Multi-factor at scale does not equal resilient authentication. With 97% of NHIs carrying excessive privileges in modern enterprises, per Ultimate Guide to NHIs , Key Challenges and Risks, the parallel lesson is clear: control presence alone is not control effectiveness. Identity programmes need assurance that survives the attack path, not just a policy that looks complete in audit evidence.

For practitioners

• Prioritise phishing-resistant authentication for securities access Move high-risk customer journeys to FIDO2 or certificate-based authentication where the service can verify the proof is bound to the intended relying party. Keep the strongest methods on login, settlement, account change, and withdrawal paths first.
• Remove weak fallback routes from critical customer journeys Review recovery flows, device replacement, and helpdesk resets so they do not silently downgrade the assurance level. Any exception that bypasses the main control should be time-bound, documented, and reviewed as part of access governance.
• Align fraud containment with IAM policy Connect authentication events to session revocation, transaction holds, and anomaly response so suspicious logins do not remain active long enough to be monetised. The useful control is rapid containment, not just better login prompts.
• Measure the gap between policy and actual adoption Track how many active customer accounts still rely on phishable MFA or legacy login methods, and report that gap separately from overall MFA coverage. Coverage numbers can conceal the residual exposure that matters most.

Key takeaways

• Japan’s securities-account guidance shows that phishable MFA is no longer enough when intermediary attacks can capture the full login flow.
• The scale of the problem is already visible in the numbers, with 676.8 billion yen in unauthorised trading reported across 2025 through August.
• Practitioners should move high-risk access to phishing-resistant authentication and close the exception paths that can silently restore the old risk.

Key terms

• Phishing-resistant authentication: An authentication method that cannot be easily replayed or relayed by an attacker who intercepts the login process. It ties the proof of identity to the legitimate service and often to a device or cryptographic key, reducing the value of stolen credentials in real-time attack chains.
• Adversary-in-the-middle attack: A live interception technique where the attacker positions themselves between the user and the service to capture or relay authentication data. The user appears to log in normally, but the attacker can steal session material, codes, or tokens that remain usable after the prompt finishes.
• Session Hijacking: Session hijacking is the takeover of an authenticated session after the original login has completed. The attacker does not need to know the password if they can use the active session token, which is why session monitoring and revocation are essential controls in SaaS identity governance.
• Assurance level: The strength of confidence that an identity claim is genuine at the moment access is granted. For consumer IAM, assurance level should reflect how resistant the login method is to phishing, replay, and interception, not just whether more than one factor was used.

What's in the full article

Cybertrust Japan's full article covers the operational detail this post intentionally leaves for the source:

• The exact wording of the Japanese Financial Services Agency update and the related industry guidance.
• The full breakdown of how intermediaries and phishing can defeat ordinary multi-factor login flows.
• The securities-specific examples of where phishing-resistant authentication is expected to apply first.
• The supporting links to related security guidance and the article's original regulatory context.

👉 Cybertrust Japan’s full post covers the regulator context, attack mechanics, and the securities use cases in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building identity controls across human, machine, and autonomous environments, it is worth exploring.