Topic starter
11/07/2026 8:48 pm
TL;DR: 676.8 billion yen in unauthorised trading shows how intermediary attacks and stolen credentials can be turned into losses, in Cybertrust Japan data through August 2025. Securities access needs stronger checks than password-based MFA when a login can unlock trading authority.
Editorial analysis by NHI Mgmt Group, based on content published by Cybertrust Japan: “å¤è¦ç´ èªè¨¼ã«ã¯ã³ã¿ã¤ã ãã¹ã¯ã¼ãã®å©ç¨ç¦æ¢ï¼è¨¼å¸å£åº§ã®ä¹ã£åã被害å¤çºã§éèåºæéãæ¹å®ã¸”.
Key questions
Q: Why do intermediary attacks make phishing-resistant authentication necessary?
A: Intermediary attacks defeat ordinary MFA because they exploit the live exchange between the user and the service.
Q: How can teams tell whether their MFA is still too easy to relay?
A: A practical sign is when a stolen login flow can be completed without the attacker needing device possession, certificate binding, or origin checks.
Q: What breaks when banks rely on login MFA instead of transaction signing?
A: Login MFA proves that a user authenticated, but it does not prove that the payment details were unchanged at approval time.
Practitioner guidance
- Replace vulnerable MFA on securities portals Move high-risk customer and client login flows to phishing-resistant methods such as FIDO2, passkeys, or certificate-based authentication where the service and device binding can be enforced.
- Separate login assurance from transaction authority Review whether a successfully authenticated session can immediately reach trading, withdrawal, or profile-change functions without additional step-up checks or contextual controls.
- Harden against intermediary attacks Validate that authentication flows resist relay, session capture, and lookalike-site abuse, especially where the user could be tricked into completing the full login flow.
Bottom line: Japan’s securities login policy shift reflects a broader move away from MFA patterns that attackers can relay through intermediary phishing.
Glossary terms: Phishing-Resistant Authentication, Adversary-in-the-Middle (AiTM), Proof-of-Possession, Transaction-Enabled Account
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 9 hours ago by NHI Mgmt Group
11/07/2026 9:15 pm
Phishing-resistant authentication is now the minimum defensible control for high-risk securities access. Once attackers can relay a live login session through intermediary attacks, password plus one-time code patterns no longer provide meaningful assurance. The governance question changes from whether MFA is enabled to whether the factor resists interception at the moment of use. Practitioners should treat this as a control-class decision, not a preference for one login experience over another.
A question worth separating out:
Q: What should firms change when securities access can lead directly to trading loss?
A: They should align authentication strength with the downstream authority of the account. If a login can immediately trigger trades or withdrawals, the login method must resist interception and replay, and sensitive actions may need additional checks. Identity assurance, fraud control, and transaction authorisation should be governed together.
👉 Read our full editorial: Multi-factor use is being banned for securities logins in Japan