Hackers manipulate markets in $700 million illicit trading spree

Criminals are hijacking online brokerage accounts in Japan and using them to drive up penny stocks around the world. The wave of fraudulent trading has reached ¥100 billion ($710 million) since it started in February and shows no signs of cresting.

The scams typically use the hacked accounts to buy thinly traded stocks both domestically and overseas, allowing anyone who has built up a position earlier to cash out at inflated values. In response, some Japanese securities firms have stopped processing buy orders for certain Chinese, US and Japanese stocks.

Eight of the country’s biggest brokers including Rakuten Securities Inc. and SBI Securities Co. have reported unauthorized trading on their platforms. The breaches have exposed Japan as a potential weak point in efforts to safeguard global markets from hackers.

They also threaten to undermine the Japanese government’s push to get more people to invest for their retirement, particularly since some victims say they are baffled as to how their accounts were broken into and the securities companies have so far largely refrained from covering the losses.

Credit: Bloomberg

Mai Mori, a 41-year-old part-time worker, said her Rakuten Securities retirement account was hacked and used to buy Chinese stocks in a transaction that cost her ¥639,777, or about 12% of her holdings. When she noticed, she contacted Rakuten, which told her to file a police report. However, the police in Aichi prefecture wouldn’t accept a criminal complaint because they said she wasn’t the victim — Rakuten Securities was. Rakuten then told her that it wasn’t at fault and therefore could not help her, according to Mori.

“The police told me that in most fraud cases, the victims often end up having to just quietly accept the loss,” said Mori. “Basically, there’s not much that can be done.”

In a response to questions from Bloomberg News on fraudulent transactions and Mori’s case, a Rakuten spokesperson said “we will continue to examine each case individually and respond in good faith.” SBI said it was listening to individual circumstances and responding promptly. SMBC Nikko Securities Inc. said it would review the circumstances of each affected customer and consider individual responses.

Monex Group Inc. also said it would consider each case individually. Matsui Securities Co. said it will handle compensation in accordance with industry guidelines and Nomura Securities Co. said it would respond flexibly based on the individual circumstances of affected customers. Daiwa Securities Group Inc. said they are reviewing the matter of compensation related to unauthorized transactions. Mitsubishi UFJ Financial Group Inc. said it will listen to the circumstances of each case and respond promptly and sincerely. The police in Aichi did not respond to multiple requests for comment.

One investor who asked not to be named to protect his privacy said he lost around 50 million yen when his account was hacked and used to buy both Japanese and Chinese individual stocks. The Tokyo resident in his mid-50s said an account notification suddenly popped up on his iPhone on the morning of April 16. Alarmed, he immediately called his brokerage and was told they could not freeze the account.

Even though he had only ever purchased index funds that tracked the S&P 500 index and had never bought individual shares, his account was used to buy stocks on margin. Faced with plummeting prices, he chose to sell the securities on the 17th and 18th to avoid further losses. Since the stocks were bought with leverage, the brokerage said it would liquidate his holdings in the S&P to cover their losses.

One of the stocks the investor said was purchased using his account was DesignOne Japan Inc. On April 16, 5.8 million shares of the stock traded hands compared with a daily average of 194,000 shares over the last six months. Bloomberg was unable to independently confirm details of the transactions in the investor's account.

Japan’s government has told brokerages to engage in “good faith” discussions with clients about compensation for losses, Finance Minister Katsunobu Kato said on April 22.

The Japan Securities Dealers Association, the umbrella group for the country’s securities firms, is also pushing its members to upgrade their systems to make multi-factor authentication mandatory. The group’s chairman, Toshio Morita, criticized the failure to provide compensation for victims, while acknowledging that it was up to each firm to set their own policy.

“It’s not acceptable to issue a blanket denial of compensation,” Morita said at a press conference on April 16. “Firms must consider each customer’s circumstances and respond appropriately.”

Cases of fraudulent trading jumped to 736 in the first half of April from 33 in February, according to Japan’s Financial Services Agency, without saying how much the victims had lost. This puts the government’s strategy of getting more people to invest at risk.

An expansion of a tax exemption program for small investments spurred a 20% rise in Nippon Individual Savings Accounts as of the end of 2024 versus the previous year, according to the FSA. That momentum has slowed down and the government might not reach its target of having 34 million users in five years, according to Yusuke Maeyama, a researcher at NLI Research Institute.

“Among people already using the system, including myself, there’s a sense that the financial firms need to do their jobs properly,” Maeyama said. “For people who haven’t been involved in investing, this can be intimidating. When issues like this come up, it just reinforces their fears.”

The criminals behind the scams are likely using techniques called adversary-in-the-middle and infostealers to gain access to the accounts, according to Nobuhiro Tsuji, a cybersecurity expert at SB Technology. The first method leverages both fake and legitimate websites to steal cookies, the small text files stored in web browsers that hold session data.

The attack typically begins by luring the user to a fake site via a phishing email or malicious ad. The fake site then redirects the user to the legitimate site, where their login credentials are intercepted. In some cases, the attackers create extremely elaborate interfaces — for example, one side of the browser shows the real site while the other displays the fake one — to deceive users.

In contrast, infostealers are a type of malware specifically designed to steal sensitive information such as IDs and passwords. Hidden in emails, malicious ads, or fraudulent websites, these programs can infect a user’s device and silently exfiltrate all stored personal data — often without the user ever realizing they’ve been compromised. There have been at least 105,000 cases of leaked credentials in Japan, according to a study done by Macnica Security Research Center.

One weakness in Japan is the propensity for people to use browsers rather than mobile apps, which have better protection, according to Yutaka Sejiyama, the deputy director of Macnica. There has not been a similar surge in cases overseas.

Many of the victims have described their losses online, including Mai Mori, who wrote a series of posts detailing the hacking of her account. Mori joined a group that shared information about their cases and bandied around the idea of jointly hiring a lawyer, but faced with the amount of time and effort it would require, she eventually left.

Instead, she’s considering closing her account with Rakuten but is unsure of which of its competitors to turn to. Face-to-face brokerages charge higher fees and she’s worried they would pressure her to buy stocks she doesn’t want. Either way, she feels trapped.

“We are so powerless,” said Mori. “It’s no use.”