The Council of Anti-Phishing Japan received 2,454,297 phishing reports in 2025, about 1.43 times the previous year and the highest total on record [1]. Scammers impersonated 229 different brands. In July of 2026, five of them (Amazon, Apple, Saison Card, JCB and e+) accounted for roughly 69% of all reports [2]. These are all services that students commonly use which explains why they were chosen.
The old advice was to simply watch for broken grammar however that advice has become outdated. In Verizon’s 2026 Data Breach Investigations Report, phishing made up 44% of the AI-assisted intrusion techniques researchers observed [3], and fluent Japanese or English without any grammatical mistakes has been made significantly easier. With that being said, there are still five ways to check for phishing emails that still work fairly well today.
The first sign of phishing to look for is a sudden sense of urgency. “Your account will be suspended if you do not do a certain action by a certain time” or “Confirmation is needed within 24 hours” and many more are major signs of phishing. Attackers will often use these scare tactics to launch the recipient into a panic which may prompt them to make an uninformed decision without taking the necessary time to analyze the situation first. In mid-2025, a wave of fake brokerage emails told people to set up multi-factor authentication or to claim compensation for earlier fraud [4]. General advice in this situation is to never trust an email that threatens consequences if action is not taken in a short period of time. Almost nobody will issue demands on such a short notice and if a timed demand is sent out they are usually sent with a very generous timeline providing you enough time to verify and perform any request safely. It is also recommended to perform any actions related to your accounts through the official app instead of whatever link is provided in the email.
The second sign of a phishing email that may not be so obvious at first, is an unofficial domain. When receiving an email, tap the senders name to reveal the full address and read everything after the @. Attackers increasingly register their own domains rather than faking a real one. In July 2026, about 73.5% of the phishing emails in the Council’s sample came from attacker-owned domains, and roughly 95% of those passed DMARC, the check mail services use to confirm a sender [2]. A “verified” sender only proves the email came from that domain. It says nothing about whether the domain belongs to Amazon. The opposite can also be true. About a quarter of July’s samples spoofed the real company’s address [2], and in March 2025 the share was 63% [5]. So an address can rule a message out, but never rule it in. The best advise is to only trust official domains and conform there are no unusual characters in the domain. For example @gmai1.com and @gmail.com may look identical to someone who does not slow down to confirm the domain is legitimate. Slow down and carefully read the address and domain. If anything looks suspicious, do not trust the sender and do not do anything the emails asks you to do.
The third sign to look out for is an embedded link that appears to go to one destination but upon further inspection, goes to a completely different address. On a laptop you can inspect embedded links by hovering over the highlighted text and viewing the destination URL at the bottom corner of your browser. On phone the same is done simply by tapping and holding the link. Two patterns seem to frequently occur in Japanese phishing data: cheap top-level domains such as .top and .cn, which made up nearly half of reported phishing URLs in July 2025, and links routed through legitimate services like Google Translate to hide the real destination amounting to about 8.5% that month [6].
The fourth tip we have is to avoid signing in to a log in page that was sent to you via email. Often times phishing emails contain false logins to steal credentials that an attacker can then use to gain access to either your own personal data or gain access that would be otherwise restricted to company information that you were entrusted with. The rule to follow is simply log in via the official app or website that you bookmark and have verified yourself. Do not trust a log in sent via email. After the 2025 brokerage account take overs, Japan’s Financial Services Agency gave customers the same advice, telling them to bookmark the real site and log in from there [7]. If the problem in the email is real, it will be waiting for you when you sign in through a link you trust anyways. Passkeys such as fingerprint and face ID can also help in this situation since they refuse to work on a fake domain.
For the fifth and final sign imagine the following scenarios. A professor requesting gift cards, a job that wants your bank details before your first shift, and a friend on LINE who “lost their phone” and needs a verification code that he just sent to yours. Any request to send money, buy prepaid cards or forward a code is a scam until you confirm it through a channel you chose, such as calling the person directly. Reach out to the person or company via chat through an account where you have previously established communication and you know for a fact that the person on the other end is who they say they are.
Now what do you do if you already clicked on a suspicious link? Understand that speed and recovery matter far more than any potential embarrassment. Change the password on that account you logged in with and anywhere else you may have used that same password, then turn on passkey or MFA(multi-factor authentication). If you entered card details, call the card company or open you banking app immediately and freeze the card as well as report any possible fraudulent charges to your financial institution. Forward the malicious email to the Council of Anti-Phishing Japan ([email protected]), and report anything touching your account to the company or university IT department. If money has already been withdrawn from your account, the Consumer Hotline is 188 and the police consultation line is #9110.
Sources
- ScanNetSecurity. "DMARC 通過する独自ドメインフィッシング急増 ~ フィッシング対策協議会「フィッシングレポート2026」." June 2026. scan.netsecurity.ne.jp
- ScanNetSecurity. "2026年7月のフィッシング報告状況、Amazonをかたるフィッシングが急増." August 2026. scan.netsecurity.ne.jp
- SC World. "Verizon DBIR 2026: Vulnerability exploits top initial access as patching coverage falls." May 2026. scworld.com
- ScanNetSecurity. "2025年7月のフィッシング報告状況、証券会社をかたるフィッシングメールの配信が再び増加." August 2025. scan.netsecurity.ne.jp
- ScanNetSecurity. "フィッシング報告件数過去最高、2025 年 3 月 報告状況." April 2025. scan.netsecurity.ne.jp
- @IT. "フィッシング対策協議会が7月の報告状況を公表." September 2025. atmarkit.itmedia.co.jp
- Infosecurity Magazine. "Japanese Account Hijackers Make $2bn+ of Illegal Trades." 2025. infosecurity-magazine.com
