Two-Factor Authentication Can No Longer Guarantee Your Safety: How to Spot Fake Government Emails and Protect Yourself from Scams
Criminals can easily log in to genuine websites
Scams impersonating government agencies continue to evolve. Fraudsters send emails claiming that your electricity bill can be reduced or that your pension payments are overdue, then trick recipients into transferring money. In the first part of this article, we introduced scam websites that display a PayPay screen when a button is clicked, allowing criminals to steal money simply by getting victims to press the payment button.
Of course, impersonating government agencies is not the only tactic scammers use.
Some fake websites display screens that look almost identical to official government websites, then use prompts such as “Please register the bank account where your subsidy will be deposited” to redirect victims to login pages for banks or credit card companies. What happens if you enter your ID and password on one of these fake websites?
Some fake websites do more than simply steal information entered into a crude imitation of a legitimate site. They position themselves between users and the genuine website, relaying communications between the two in real time.
In other words, information entered by victims on the fake website is immediately forwarded to the legitimate website, allowing criminals to log in to the real site using the stolen credentials.
The legitimate website assumes the access is coming from the account holder and sends a verification code to the person’s smartphone. When the victim enters that code into the screen in front of them, the code is also forwarded to the legitimate website, completing the login process. Two-factor authentication is bypassed with ease. The criminals then use the compromised account to make transfers or payments on the spot.
As these scams become increasingly sophisticated, it is now difficult for people to determine for themselves whether emails and websites are genuine. Even experts who remain vigilant in their daily lives sometimes encounter situations that feel dangerous, says Michiaki Yoshioka, secretary-general of the Anti-Phishing Council.
“It’s not just elderly people who fall victim to these scams anymore. They affect people of all generations. Even those who are usually careful can get caught out. I myself once received an email at a time when I was conducting a transaction through a service I was actively using, and I thought, ‘This is dangerous.’” (Yoshioka)
What is needed is not simply greater vigilance. Rather, people need behavioral rules that prevent them from being deceived in the first place, along with technology that protects them at the system level.
First, make it a firm rule never to open a login page through a link in an email or SMS message.
Do not click links prompting you to complete the procedure here or buttons urging you to check immediately. Instead, visit the official website using a bookmark you saved in advance, or open the official app to verify the information. Simply following this one rule can prevent you from reaching a fake website in the first place.
Government agencies also do not normally send individuals emails asking them to enter their credit card numbers or requesting that they transfer money through an app. The warning issued by the Agency for Natural Resources and Energy mentioned at the beginning of this article emphasized precisely this point.
Relying on “Technology” for Security
Next, you can use the information displayed in your inbox as a clue. Depending on the email app you use on your smartphone, when you open your message list, you may see circular icons to the left of each sender’s name. Some display company logos, such as those of Mizuho Bank or JCB, while others show only a gray silhouette of a person. This difference is not coincidental.
Logos appear next to senders that support a system called BIMI (Brand Indicators for Message Identification).
Email services such as Gmail automatically check incoming messages to determine whether the sender’s domain has been spoofed. Only emails that pass this verification display the company’s logo. To have a logo displayed in emails, the sender must first undergo screening by a certification authority and obtain a certificate. Because ownership of the logo is strictly verified, it is impossible for scam groups to obtain a certificate using another company’s logo, such as that of Mizuho Bank.
However, the absence of a logo does not necessarily mean an email is fake. Many companies and government ministries have yet to adopt the system, so their messages may still display a gray silhouette icon or simply the sender’s initials. Nevertheless, government agencies are also beginning to take action, and relevant ministries have indicated that they intend to adopt the system. Before long, we may see government emails displaying official logos. In any case, it is best to regard a logo as a helpful indicator for identifying senders you can trust.
Then there are passkeys.
This system uses fingerprint or facial recognition to turn your smartphone or computer itself into a key. A separate key is created for each service. For example, if you register a passkey with Mizuho Bank, a key linked to Mizuho Bank’s address is stored on your device. As a result, even if you open a fake website that looks exactly like the real one, the key will not respond if the address is different, and the facial or fingerprint recognition screen will not even appear. Even if you are convinced that the site is genuine, your device will block the attempt. Your password is never transmitted over the internet, either. If a service you use offers passkeys, it is well worth registering one.
The global slogan promoted by the Anti-Phishing Council is “STOP. THINK. CONNECT.” This means “Stop, think, and enjoy”—a phrase that represents the basic habits needed to enjoy the internet safely.
When an email arrives designed to make you panic, take your finger off the screen for a moment. Rather than trusting your own eyes too much, use technology that protects you behind the scenes. That is the most reliable way to safeguard your daily life and your assets.