Multi-factor use is being banned for securities logins in Japan

At a glance

What this is: Japan’s securities sector is tightening login rules after intermediary attacks and stolen credentials contributed to roughly 676.8 billion yen in unauthorised trading through August 2025.

Why it matters: For IAM teams, this is a clear signal that phishing-resistant authentication must replace weaker multi-factor patterns wherever account takeover can directly trigger financial loss.

Context

Japan’s securities login rules are shifting because account takeovers are being used directly for fraudulent trading, not just for isolated credential misuse. In this case, the control question is whether multi-factor authentication can still be trusted when the attack sits between the user and the legitimate service.

The article links the policy change to intermediary attacks such as adversary-in-the-middle phishing, where the attacker relays the login session and captures authentication material in real time. That makes password plus one-time code patterns materially weaker than phishing-resistant methods for securities accounts.

For identity governance teams, the key issue is not whether MFA exists, but whether the factor actually binds the session to the intended user and device. Where financial transactions can follow immediately after login, authentication strength becomes a direct fraud-control decision, not a convenience setting.

Key questions

Q: What breaks when banks rely on login MFA instead of transaction signing?

A: Login MFA proves that a user authenticated, but it does not prove that the payment details were unchanged at approval time. Attackers can still manipulate the transaction in the browser, intercept the session, or alter the destination after login. Transaction signing binds the action itself, which is what stops fraud when the user identity has already been established.

Q: Why do intermediary attacks make phishing-resistant authentication necessary?

A: Intermediary attacks defeat ordinary MFA because they exploit the live exchange between the user and the service. Phishing-resistant methods reduce that relay risk by binding authentication to the real origin or device. For sensitive financial accounts, that matters more than the number of factors, because the attacker’s goal is session theft, not password cracking.

Q: How can teams tell whether their MFA is still too easy to relay?

A: A practical sign is when a stolen login flow can be completed without the attacker needing device possession, certificate binding, or origin checks. If a user can be tricked into entering a code on a fake site and the service still accepts it, the control is vulnerable to relay. That is not phishing resistance.

Q: What should firms change when securities access can lead directly to trading loss?

A: They should align authentication strength with the downstream authority of the account. If a login can immediately trigger trades or withdrawals, the login method must resist interception and replay, and sensitive actions may need additional checks. Identity assurance, fraud control, and transaction authorisation should be governed together.

Technical breakdown

Why intermediary attacks defeat conventional multi-factor authentication

Adversary-in-the-middle phishing works by inserting the attacker into the live authentication flow, often through a fake login page or proxy that relays the user’s credentials and second factor to the real service. The attacker does not need to break encryption or guess passwords if the user willingly completes the login in a manipulated session. One-time passwords, SMS codes, and app prompts can all be reused in real time when the attacker controls the channel. That is why multi-factor alone is not the same as phishing resistance. The control boundary must bind authentication to the genuine origin and device, not just to a second proof that can be proxied.

Practical implication: Treat legacy MFA as insufficient for high-value securities access when phishing proxies can harvest the full login flow.

Why phishing-resistant authentication changes the assurance model

Phishing-resistant authentication changes the assurance model by making the credential presentation harder to relay to an attacker in another session. FIDO2, passkeys, and certificate-based authentication rely on cryptographic binding to the origin or device, which is much harder to replay through a fake site. In practice, this shifts the defence from code entry to proof of possession that is bound to the legitimate service context. For regulated financial accounts, that matters because the main question is not whether the user typed a code, but whether the session can be hijacked before the transaction begins. The best result is reduced reliance on user judgement during login.

Practical implication: Prefer authentication methods that bind the session to the real site or device rather than a code the user can be tricked into sharing.

Why securities logins need transaction-aware access controls

A securities login is not just an identity event. It is the front door to trading, withdrawals, and account changes, so the authentication method has to be evaluated in the context of downstream financial actions. If an attacker can complete login, session continuity and account action permissiveness become the real risk amplifiers. That is why risk-based controls should consider the combination of login method, device trust, and what the user can do immediately after authentication. In this sector, identity assurance and transaction authorisation are tightly coupled. Weak login design can turn a single compromised session into direct monetary loss.

Practical implication: Align authentication strength with the transactional power of the account, not just with the login page itself.

Threat narrative

Attacker objective: The attacker seeks to take over securities accounts and convert authenticated access into unauthorised trading gains.

1. Entry occurs through intermediary attacks or stolen credentials that let the attacker capture a legitimate login session rather than breaking the service directly.
2. Credential abuse follows when the attacker reuses the captured authentication material to reach the securities account as if the user were present.
3. Impact occurs when the compromised session is used for unauthorised trading and related account activity at financial scale.

Breaches seen in the wild

• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.
• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Phishing-resistant authentication is now the minimum defensible control for high-risk securities access. Once attackers can relay a live login session through intermediary attacks, password plus one-time code patterns no longer provide meaningful assurance. The governance question changes from whether MFA is enabled to whether the factor resists interception at the moment of use. Practitioners should treat this as a control-class decision, not a preference for one login experience over another.

Session relay, not password guessing, is the current account-takeover problem in financial services. The article shows why identity programmes built around credential strength alone miss the operational reality of modern phishing. When the attacker sits between the user and the service, authentication must be evaluated for origin binding, device binding, and replay resistance. Security teams should stop measuring login strength by factor count and start measuring whether the session can be proxied.

Identity assurance and transaction risk can no longer be governed separately. In securities environments, login success immediately unlocks trading capability, so weak authentication becomes a fraud-enablement issue. That means IAM, fraud, and digital-channel security need a shared view of authentication assurance and post-login privilege. Practitioners should reframe the login policy as part of financial loss prevention, not just access management.

Financial regulators are forcing a reset on what “multi-factor” means in practice. This policy direction signals that conventional MFA is being reclassified as inadequate for high-value consumer access where phishing proxies are common. That has implications beyond securities, because any regulated workflow with direct monetary impact will face the same pressure to adopt stronger proof-of-possession methods. Teams should expect authentication standards to converge on phishing resistance as the default expectation for sensitive transactions.

Authentication method selection is becoming a governance control, not a technical detail. The article reinforces that organisations cannot defer this decision to user convenience or broad rollout simplicity. Different login methods create different fraud exposures, and the control objective is to prevent real-time interception from becoming business loss. Practitioners should treat authentication policy as part of risk acceptance, with explicit ownership and review.

What this signals

Phishing resistance is becoming the real benchmark for high-risk authentication. For securities and similar regulated channels, the practical question is whether a login method can survive relay, replay, and real-time interception, not whether it satisfies a generic MFA requirement.

Multi-factor that can be proxied is no longer enough for transaction-enabled accounts. The governance shift here is broader than Japan, because any workflow that turns authentication into direct financial authority will face the same pressure to move toward stronger proof-of-possession methods.

For practitioners

• Replace vulnerable MFA on securities portals Move high-risk customer and client login flows to phishing-resistant methods such as FIDO2, passkeys, or certificate-based authentication where the service and device binding can be enforced.
• Separate login assurance from transaction authority Review whether a successfully authenticated session can immediately reach trading, withdrawal, or profile-change functions without additional step-up checks or contextual controls.
• Harden against intermediary attacks Validate that authentication flows resist relay, session capture, and lookalike-site abuse, especially where the user could be tricked into completing the full login flow.
• Reassess legacy MFA exception policies Identify any securities or financial channels that still rely on SMS, OTP, or app-push approval as the primary control and define a retirement path for those exceptions.

Key takeaways

• Japan’s securities login policy shift reflects a broader move away from MFA patterns that attackers can relay through intermediary phishing.
• The core risk is not password loss alone but live session capture that can be converted into fraudulent trading.
• Practitioners should align authentication strength with the financial authority unlocked after login and retire easy-to-proxy MFA methods.

Key terms

• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Adversary-in-the-Middle (AiTM): An attack pattern where the adversary sits between the user and the service to capture or replay authentication data and session state. The victim may still log in successfully, which is why the compromise often appears legitimate until privileged actions begin. AiTM is especially dangerous for admin workflows that trust issued sessions too much.
• Proof-of-Possession: Proof-of-possession binds a token or credential to a specific key so possession of the token alone is not enough to use it. For AI agents, it reduces replay risk and helps ensure that an intercepted credential cannot be reused by a different actor.
• Transaction-Enabled Account: An account whose successful login immediately unlocks high-impact actions such as trading, transfers, or profile changes. For these accounts, authentication strength and downstream authorisation must be governed together because access is directly convertible into financial loss.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.