Chinese Criminals Blamed for Record Japan Bank Cybertheft

Japanese savers keeping their money in banks are falling prey to cybertheft in record numbers, and police say Chinese crime groups are increasingly to blame.

Criminals stole 1.85 billion yen ($16 million) from accounts at lenders including Mitsubishi UFJ Financial Group Inc. and Sumitomo Mitsui Financial Group Inc. in the six months ended in June, surpassing the full-year record of 1.41 billion yen in 2013, according to the National Police Agency. Of 133 related arrests in the first half of the year, Chinese nationals made up the largest group with 83, or 62 percent, almost double the arrests of Japanese. Last year, 59 Chinese were arrested for bank cybertheft, up from 14 in 2012, the first year the agency separated data by nationality.

“We see a very deep Chinese connection in these cybertheft cases,” said Arichika Eguchi, the police agency’s director of cybercrime investigations. “Japanese people’s wealth is draining into China.”

The scams go like this, according to police: Chinese gangs hack into Japanese bank accounts by tricking customers into giving up their passwords or opening malicious software. They steal the money by transferring it to other accounts in Japan, then hire people who live in the country to withdraw the cash at automated teller machines. Those people deliver the money to colleagues in Japan who use it to buy goods that are shipped to China. There, the products are sold, with the proceeds going to the ringleaders.

Customer Alerts

Japan’s biggest banks -- Mitsubishi UFJ, Sumitomo Mitsui and Mizuho Financial Group Inc. -- are alerting customers about the increase in online theft and compensating victims on a case-by-case basis, spokesmen for the three companies said.

The country is an easy target because of its wealth and close proximity, as well as a lack of experience dealing with computer hacking, according to Hiroshi Koide, an associate professor at Kyushu Institute of Technology.

“Japanese people and companies aren’t very sophisticated when it comes to computer security,” said Koide, who advises the Fukuoka Prefectural Police on cybercrime countermeasures. “Japan’s huge assets ensure big profits.”

The rising number of arrested Chinese suggests they’re learning to navigate Japanese-language information systems, Eguchi said. Seventy percent of the accounts where stolen money was parked belonged to Chinese, compared with 26 percent held by Japanese, police agency data show.

China Surge

Losses stemming from online theft go well beyond the $16 million stolen from Japanese bank accounts. The price of cybercrime targeting consumers in Japan was estimated at $1 billion last year by Symantec Corp. in its Norton Report. The U.S. topped the list with $38 billion in costs, followed by China at $37 billion, the data security company’s report showed.

Fraud using the Internet, phones and text messages is surging within China, where more than 300,000 cases involving at least 10 billion yuan ($1.6 billion) were reported to police in 2013, China’s Economic Information Daily reported in October. The number of cases has increased about 70 percent each year since 2011, the newspaper said.

The Ministry of Foreign Affairs in Beijing didn’t respond to faxed questions seeking comment on cybercrime.

College Students

In Japan, many of the people arrested are the foot-soldiers who withdraw cash for their bosses.

“They’re usually exchange students and trainees from China” who accept employment without noticing that they’re becoming part of organized crime, said Eguchi. “They think it’s just a part-time job.”

One college student suspected of getting caught up in the scams is Dai Wan. The 22-year-old Chinese woman was arrested after withdrawing almost 12 million yen stolen from Japanese online-banking accounts, according to police in Kyoto.

Acting on instructions received from her superiors using the Chinese-language QQ text-message service, Dai allegedly took out the money from ATMs at convenience stores in the city over two months starting in March, said Kyoji Shibata of Kyoto Prefectural Police’s anti-cybercrime department. She is accused of sending the cash to Chinese residents in Japan to buy luxury goods and diapers, which were probably shipped to China to be sold at higher prices, according to Shibata.

Dai was charged with theft and the transfer of criminal proceeds and is being detained for trial in Kyoto District Court, Shibata said.

‘Multiple Returns’

Dai’s lawyer, Hiromasa Nakaya, said his client wasn’t aware that she was committing a crime or working for gangs. She thought she was performing a legitimate part-time job, Nakaya said, adding that her next hearing is Jan. 15.

“We’re often seeing Chinese names in online-banking thefts and illegal transactions,” Shibata said. “The money they steal in Japan will end up giving them multiple returns in China.”

Police haven’t been able to find the China-based masterminds behind the crimes because investigation becomes difficult once the money trail leaves Japan, he said.

Authorities around the world are urging banks to step up vigilance against online assaults such as the one at JPMorgan Chase & Co. in the U.S. this year. Hackers compromised the personal information of about 76 million households and 7 million small businesses in one of the largest cyberattacks ever. Sony Corp.’s entertainment unit yesterday canceled plans to release the movie “The Interview” after hackers broke into its computers and threatened violence against film fans.

Joined Forces

Mitsubishi UFJ, Mizuho and Sumitomo Mitsui have joined forces with Japanese authorities to stem the increase in online robberies. The three Tokyo-based firms and the National Police Agency are among 20 members of the Japan Cybercrime Control Center, a nonprofit organization formed in November to address online threats.

The 1.85 billion yen in banking cyberthefts reported in the six months through June compares with 48 million yen in 2012 and 308 million yen in 2011, when the National Police Agency began collecting the data. The cash was stolen from accounts at 73 Japanese lenders in the first half, and 1,280 individuals and 572 companies were victims, the figures show.

Software containing viruses that allow thieves to steal information about bank accounts is partly behind the increase, said Eguchi. Criminals also use phishing, which involves duping people into handing over personal data, he said.

Cat and Mouse

When customers visit the website of Bank of Tokyo-Mitsubishi UFJ Ltd., the main lending unit of Japan’s biggest bank, they see a red-and-yellow warning sign with text urging them not to enter their passwords in response to e-mails purporting to come from the company. The site also alerts users to computer viruses and offers protective software.

“It’s a game of cat and mouse,” Japanese Bankers Association Chairman Nobuyuki Hirano, who is also president of Mitsubishi UFJ, said at an October news briefing. “They always come up with tricks that seem to be one step ahead of our defenses.”

Japan and China should better cooperate in tracking down ringleaders, given that both nations are members of the International Criminal Police Organization, or Interpol, Eguchi said. The police agency held talks with its Chinese counterpart for the first time in four years in October, and Japan sought cooperation on crimes including cybertheft, he said.

The same month, Japanese Prime Minister Shinzo Abe’s cabinet endorsed a proposal to bolster a law aimed at stopping criminals from transferring the proceeds of their activities. The proposed legal changes include clarifying suspicious transactions so that financial institutions can report them to regulators, Finance Ministry documents showed.

“International cooperation is required to investigate criminal organizations outside the country,” said Kyushu Institute’s Koide. “Japan can’t handle this alone.”

Before it's here, it's on the Bloomberg Terminal.