An Email From the “President” Asking You to Make a LINE Group: Don’t Send the QR Code — Call Them Instead; Japan’s Police Counted 127 Fake-President Frauds, About 3.88 Billion Yen, in Six Months

Hello! I am Shemihaza, the sentinel.
Today: emails that arrive in the name of your company’s “president.”
The short answer: if an email in the president’s name tells you to create a LINE group and send back the QR code, do not follow it, do not reply, and check with the president by phone or another channel.

Today’s real example. Japan’s National Police Agency (NPA) covered the “fake-president fraud” (ニセ社長詐欺) in its report on cyber threats in the first half of 2026, published on 10 September 2026. From January to June 2026 it counted 127 cases and about 3.88 billion yen in losses, and says the loss per completed case was about 31 million yen. The Council of Anti-Phishing Japan’s monthly report for August 2026 (published 18 September) also says reports of emails that use a company president’s name to have staff create a LINE group and then steer them to a transfer scam kept arriving in large numbers, as in the previous month.

This is not only for office workers. According to the NPA, the emails go to company email addresses that are public online. They could reach your employer, your part-time workplace, or a small family business (our addition). First, what is known and what is not. The flow and the advice are published by the NPA and by IPA (Japan’s Information-technology Promotion Agency). What is not published is the industry and size of the targeted companies, and how the criminals got the presidents’ names.

From an email in the boss’s name to a transfer

• ▸1. An email in the boss’s name arrives. The NPA says a person posing as an executive emails a company address that is public on the internet. A real president’s name and a real company name are used, so it is hard to notice (NPA)
• ▸2. You are told to create a group. Posing as work (“for a new project”), they tell you to create a messenger group and send back its invitation QR code (NPA). IPA gives these lines as examples: “Create a LINE group and reply with the QR code.” and “Do not let anyone else into the group.” The NPA adds that you may also be told to include the person who has authority to make transfers
• ▸3. They impersonate the boss in the group and ask about accounts. The NPA says that in the group chat they get you to disclose the company’s account balance and similar details. IPA has confirmed cases where the boss is impersonated in a LINE group and a large transfer is ordered as a work instruction
• ▸4. You are told to transfer money to their account. They say things like “business funds are urgently needed” or “please pay a client on my behalf” and have you transfer money to the account they specify (NPA). Following the instruction causes the financial loss (IPA)

How to spot it (IPA’s list) and our additions

• ▸IPA feature 1: the sender’s display name can be the name of your own or a partner’s president or employee. IPA infers the names are taken from public or leaked information
• ▸IPA feature 2: the sender’s address is a free-mail address such as outlook.com, hotmail.com or gmail.com. Even when the display name is the president’s, the address is not the company’s
• ▸IPA feature 3: the recipient is often your own company’s mailing-list address, and the subject is often your company’s name. IPA says the same email is sent in bulk to many recipients
• ▸IPA feature 4: the body pretends to be a work instruction. For example “Create a LINE group and reply with the QR code.” and “Do not let anyone else into the group.” In a few cases there is also an attachment meant to infect the computer with malware (IPA)
• ▸Our addition: a display name and a “presidential” tone prove nothing. Real president and company names are used (NPA). The “do not let anyone else in” instruction is probably meant to keep you from asking colleagues (our reading; the public material does not give a reason)

What you can do today

• ✓★Do not follow the email. Do not create the group. Do not send back the QR code. IPA asks readers not to follow the content of the email and to report it inside the company if needed
• ✓Check with the president by phone or another channel, not by replying to that email. IPA says to confirm without replying to the email you received
• ✓Do not open links in the body, and do not open attachments. IPA’s advice
• ✓When unsure, do not decide alone. If your company has a rule for suspicious emails, follow it and report. If in doubt, ask the IT or system staff or colleagues (IPA)
• ✓If you run a company or handle payments, share this inside and review your transfer rules. The NPA asks companies to share this type of case internally and re-check their rules on transfers. IPA suggests an approval flow such as a double check on payments
• ✓Tell your family too. Send the “three lines to send to family” below to relatives who work at a company or run one

If you already created the group and sent back the QR code

• ▸1. Stop the exchange and do not discuss money or accounts. (our addition)
• ▸2. Report the group and leave it right away. The NPA says that if the chat or profile screen has a “report” function, report it, then promptly leave the group
• ▸3. Tell your manager or IT staff immediately. IPA says to report according to company rules where they exist. Do not carry it alone
• ▸4. If you gave account details or already transferred money, every minute counts. The NPA and IPA pages do not give concrete steps for this stage. As our addition, contact the police: call 110 if you are losing, or about to lose, money right now; if unsure, call the police consultation line #9110. Contact the receiving financial institution quickly as well (our addition)

Spot-the-scam quiz

Imagine this.

Three lines to send to family

• ▸If an email in your company president’s name says “create a LINE group and send back the QR code,” do not follow it. Japan’s police counted 127 fake-president frauds and about 3.88 billion yen in losses from January to June 2026
• ▸★To check, do not reply to that email; contact the president by phone or another channel. If you already made the group, report it and leave right away
• ▸When unsure, do not decide alone; tell your manager. For police advice call #9110, if money is about to be taken call 110, and for contract or billing trouble call the Consumer Hotline 188. (#9110, 110 and 188 are Japanese numbers)

Where to get help

If you are unsure whether something is a scam, go to your nearest police station or call the police consultation line #9110 (Japan). If money is being taken, or is about to be taken, right now, call 110 (our addition, based on NPA guidance).
For contract or billing trouble, call the Consumer Hotline “188.” It is a nationwide Japanese number that connects to your local consumer center.
For advice on the security of company computers and email, IPA runs a cybersecurity consultation desk (follow the link from the IPA page under “Pages this article is based on”).

What I could not confirm

• ▸The industry and size of the companies behind the 127 cases, and how many emails were sent. The NPA report does not say
• ▸How the criminals got the presidents’ names and the company email addresses. IPA only “infers” that they come from public or leaked information. It is not confirmed
• ▸Whether individual or household victims are included in the figure. The NPA calls them corporate victims and does not explain individuals
• ▸The number of cases from July 2026 onward. The NPA figure covers January to June. The Council of Anti-Phishing Japan says reports kept coming in August, but gives no count
• ▸How IPA’s consultation count (106 between 16 December 2025 and 10 March 2026) relates to the NPA’s reported cases. IPA said that at that time no consultation to its desk had developed into a financial loss. They count different things (consultations to a help desk versus cases the police know of), so they cannot be added or compared (our reading)
• ▸Concrete steps after a transfer has been made. The NPA and IPA pages did not give them

Pages this article is based on