Japanese online broker Mitsubishi UFJ eSmart Securities has confirmed unauthorized customer-account access linked to phishing attacks that exploit email-based one-time passwords, exposing weaknesses in an authentication method intended to protect investors from stolen login credentials.
In an October 15, 2026 security warning, the brokerage said criminals were operating fraudulent websites and distributing emails impersonating the company to collect customer login information. The stolen credentials have subsequently been used in unauthorized account-access incidents, including cases involving the misuse of email one-time password authentication.
The disclosure is particularly significant because the broker already offers stronger authentication methods and introduced telephone-based verification on October 5. The latest warning indicates that attackers are continuing to exploit customers who rely on email verification despite the availability of alternative security controls.
Mitsubishi UFJ eSmart Securities did not disclose the number of compromised accounts, whether unauthorized trading or withdrawals occurred, or whether any customers suffered financial losses.
Broker Confirms Phishing-Related Unauthorized Account Access
According to Mitsubishi UFJ eSmart Securities’ October 15 security notice, the company has identified numerous fraudulent websites and suspicious emails impersonating its brokerage services.
The firm said customer information entered into these websites has been misused in unauthorized-access incidents, confirming that the threat extends beyond attempted credential theft.
More importantly, the brokerage specifically acknowledged cases involving the exploitation of email-based one-time passwords used during login.
These temporary authentication codes are normally intended to provide an additional security barrier beyond a customer’s account ID and password. However, phishing websites can trick users into disclosing both their primary credentials and the temporary codes needed to complete authentication.
The broker did not explain the precise technical sequence used in the confirmed incidents or whether attackers accessed customers’ email accounts directly.
The distinction matters because capturing a verification code through a fraudulent login page does not require compromising the brokerage’s internal authentication servers.
At this stage, the company’s disclosure establishes unauthorized customer-account access but does not demonstrate a security breach of Mitsubishi UFJ eSmart Securities’ own infrastructure.
Fraudulent Emails Impersonate Former au Kabucom Securities Brand
The October 15 warning also identifies a specific phishing campaign designed to exploit the brokerage’s former corporate identity.
The fraudulent emails use the Japanese-language subject line “au Kabucom Securities: Request to Migrate to Next-Generation Authentication (Passkey),” presenting the message as an important account-security update.
Recipients are directed toward a supposed passkey-registration process that instead leads to a counterfeit Mitsubishi UFJ eSmart Securities login website.
The impersonation is noteworthy because au Kabucom Securities is not an unrelated financial institution. It was the brokerage’s previous name before its rebranding on February 1, 2025.
The company became a wholly owned subsidiary of Mitsubishi UFJ Bank in January 2025, strengthening its position within Mitsubishi UFJ Financial Group.
By using the former brand in an email and presenting a login page resembling the current brokerage, attackers can take advantage of customers’ familiarity with both corporate identities.
The company warned that its legitimate emails do not contain direct login links and instructed customers not to enter their credentials on pages reached through suspicious messages.
A comparable use of security-related deception appeared in the recent Coldcard phishing incident, where a fraudulent wallet-security message attempted to redirect customers toward an unauthorized migration website.
The incidents are unrelated, but both show how attackers can present a supposed security improvement as the reason customers should visit a malicious website.
Telephone Authentication Introduced October 5 as Passkey Transition Continues
Mitsubishi UFJ eSmart Securities has urged customers using email-based one-time passwords to switch to telephone authentication, which the brokerage introduced on October 5, 2026.
The company explained that enabling telephone authentication automatically replaces email one-time password verification as the relevant two-factor authentication method.
Customers who already use passkeys have been advised to disable alternative login methods, including conventional account ID and password authentication, so that passkeys become their exclusive login option.
The brokerage previously announced authentication improvements in August, including support for registering passkeys across multiple devices and the ability to disable non-passkey login methods.
Its security documentation identifies the end of October 2026 as the target period for making passkeys mandatory across supported login devices, although the implementation date remains subject to the progress of customer migration.
Passkeys use cryptographic authentication tied to legitimate services, making them substantially more resistant to conventional phishing than passwords accompanied by manually entered verification codes.
The latest disclosure therefore comes during an existing security transition rather than marking the initial introduction of stronger authentication.
Japan’s Securities Industry Has Faced Widespread Account-Takeover Attacks
The warning comes against a broader pattern of phishing-related brokerage-account compromises in Japan.
Japan’s Financial Services Agency reported that unauthorized access to securities accounts resulted in 6,380 account hijackings and 3,505 unauthorized transactions during the first four months of 2025.
The affected accounts were associated with approximately ¥161.2 billion in securities sales and ¥143.7 billion in purchases during that period. These figures describe unauthorized trading activity rather than equivalent realized customer losses.
Japanese regulators and industry associations have subsequently pushed securities companies toward phishing-resistant authentication, including passkeys.
The Japan Securities Dealers Association reiterated in March 2026 that fraudulent websites, malicious applications and stolen credentials remained significant threats to customers using internet-based trading services.
For Mitsubishi UFJ eSmart Securities, the October 15 notice does not establish whether any of the newly identified unauthorized logins resulted in trading activity.
The brokerage provides securities, foreign exchange and CFD trading services, but its announcement does not specify which account categories were affected.
Why Email OTP Protection Can Fail Even When Two-Factor Authentication Is Enabled
The most important lesson from this disclosure is that enabling two-factor authentication does not automatically prevent account takeovers.
Email one-time passwords add a useful layer of protection against attackers who possess only a stolen password. But they become less effective when customers are persuaded to enter the temporary code into a fraudulent website.
Attackers can potentially use those details to complete a legitimate authentication attempt while the victim believes they are interacting with the brokerage.
That is different from breaking the encryption or authentication technology itself. The attacker is exploiting the customer’s trust in the website rather than necessarily defeating the underlying security controls.
Passkeys can address much of this vulnerability because authentication is cryptographically associated with the legitimate website. A counterfeit domain cannot ordinarily obtain the same authentication response simply by imitating the original login page.
However, the protection depends on implementation. If a brokerage allows customers to bypass passkeys through conventional passwords or weaker recovery procedures, attackers may concentrate on those alternatives.
This explains why Mitsubishi UFJ eSmart Securities is encouraging customers not merely to register passkeys, but to disable other login methods where possible.
Unauthorized Trading Could Be More Important Than Stolen Passwords
For investors, the immediate concern is what an attacker can actually do after gaining access to an account.
An unauthorized login might expose portfolio holdings, transaction histories and personal information. Depending on account permissions and additional verification requirements, it could also create opportunities for unwanted trading activity or attempts to change account settings.
The consequences can become especially serious in leveraged FX and CFD accounts, where unauthorized positions may generate losses without requiring funds to leave the brokerage.
Dave Finances recently examined allegations of repeated unauthorized MT5 account access at VT Markets, including disputed password changes and questions about how trading accounts should be secured while suspicious activity is investigated.
Unlike that individual customer allegation, Mitsubishi UFJ eSmart Securities has itself confirmed unauthorized-access incidents. However, neither case should be interpreted as proof of an internal broker-system breach without supporting technical evidence.
The Japanese brokerage has also not identified any unauthorized trades or withdrawals associated with its newly disclosed cases.
The Passkey Migration Creates a New Social Engineering Opportunity
There is an uncomfortable irony in the phishing campaign: criminals are using the brokerage’s move toward stronger security as the pretext for stealing credentials.
Customers receiving a warning about mandatory authentication changes may regard it as credible, particularly when the company has genuinely announced plans to transition away from older login methods.
The existence of a legitimate security deadline can make a fraudulent message appear more urgent.
That is why the communication strategy surrounding a security upgrade matters almost as much as the technology being introduced.
If customers cannot reliably distinguish genuine instructions from fraudulent messages, attackers can exploit the confusion generated by the transition.
A similar concern emerged in the Based crypto-card security investigation, which highlighted how attackers can use convincing impersonation and account-related information to persuade customers to compromise their own security.
The practical challenge for Mitsubishi UFJ eSmart Securities is to make legitimate authentication changes accessible through trusted, independently verified channels rather than links delivered through unsolicited messages.
Account Numbers, Losses and Affected Trading Services Remain Unclear
The October 15 disclosure establishes a confirmed security problem, but several important questions remain unanswered.
The brokerage has not reported how many customers experienced unauthorized logins, when the incidents began or whether the same phishing infrastructure was responsible for every case.
It has also not explained whether affected accounts included ordinary securities portfolios, FX trading accounts or CFD services.
Another unanswered question concerns whether attackers succeeded in placing orders, altering account information or initiating withdrawals after obtaining access.
Those distinctions would materially affect the severity of the incident. A detected unauthorized login that was promptly contained represents a different financial exposure from an account takeover that allowed unauthorized transactions.
The company could provide greater clarity by disclosing the scale of confirmed access incidents, the authentication methods involved and whether customers have reported financial harm.
For now, the October 15 warning demonstrates that phishing attackers have successfully exploited email OTP authentication at Mitsubishi UFJ eSmart Securities, even as the broker moves toward stronger verification.
The larger question is whether its migration to passkeys and telephone authentication can close the remaining account-access weaknesses before criminals identify another route into customer accounts.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574