Topic starter
11/07/2026 8:48 pm
TL;DR: Japan’s securities industry is moving to require phishing-resistant authentication after unauthorised trading driven by intermediary attacks and stolen credentials reached about 676.8 billion yen across 2025 to August, according to Cybertrust Japan. Password-based multi-factor alone is no longer a sufficient control boundary for high-risk financial accounts.
Editorial analysis by NHI Mgmt Group, based on content published by Cybertrust Japan: “å¤è¦ç´ èªè¨¼ã«ã¯ã³ã¿ã¤ã ãã¹ã¯ã¼ãã®å©ç¨ç¦æ¢ï¼è¨¼å¸å£åº§ã®ä¹ã£åã被害å¤çºã§éèåºæéãæ¹å®ã¸”.
Key questions
Q: What breaks when banks rely on login MFA instead of transaction signing?
A: Login MFA proves that a user authenticated, but it does not prove that the payment details were unchanged at approval time.
Q: Why do intermediary attacks make phishing-resistant authentication necessary?
A: Intermediary attacks defeat ordinary MFA because they exploit the live exchange between the user and the service.
Q: How can teams tell whether their MFA is still too easy to relay?
A: A practical sign is when a stolen login flow can be completed without the attacker needing device possession, certificate binding, or origin checks.
Practitioner guidance
- Replace vulnerable MFA on securities portals Move high-risk customer and client login flows to phishing-resistant methods such as FIDO2, passkeys, or certificate-based authentication where the service and device binding can be enforced.
- Separate login assurance from transaction authority Review whether a successfully authenticated session can immediately reach trading, withdrawal, or profile-change functions without additional step-up checks or contextual controls.
- Harden against intermediary attacks Validate that authentication flows resist relay, session capture, and lookalike-site abuse, especially where the user could be tricked into completing the full login flow.
Bottom line: Japan’s securities login policy shift reflects a broader move away from MFA patterns that attackers can relay through intermediary phishing.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 9:15 pm
Phishing-resistant authentication is now the minimum defensible control for high-risk securities access. Once attackers can relay a live login session through intermediary attacks, password plus one-time code patterns no longer provide meaningful assurance. The governance question changes from whether MFA is enabled to whether the factor resists interception at the moment of use. Practitioners should treat this as a control-class decision, not a preference for one login experience over another.
A question worth separating out:
Q: What should firms change when securities access can lead directly to trading loss?
A: They should align authentication strength with the downstream authority of the account. If a login can immediately trigger trades or withdrawals, the login method must resist interception and replay, and sensitive actions may need additional checks. Identity assurance, fraud control, and transaction authorisation should be governed together.
👉 Read our full editorial: Multi-factor use is being banned for securities logins in Japan