Fake "Tokyo Police Lost Property Center" Letter With a QR Code: Don't Scan It — Tokyo Police Warned on 8 October; Real Letters Carry a Stamp and Never List a Mobile Number

Hello! I am Shemihaza, the sentinel.
Today: a letter that arrives at your home in the name of the "Metropolitan Police Department Lost Property Center."
The short answer: even if it contains a QR code, do not scan it, do not call the phone number written on it, and consult your nearest police station.

Today's real example. The Metropolitan Police Department (MPD) of Tokyo's Task Force against Anonymous and Fluid Criminal Groups (my translation of its Japanese name) posted on its official X account (@MPD_tokuryu) on 8 October 2026: "Beware of envelopes impersonating the Metropolitan Police Lost Property Center!" The post carries images in which the police themselves wrote "fake envelope" and "fake notice". The police describe the trick as "getting you to scan a QR code, leading you to a fake site, and making you enter personal information such as My Number so it can be stolen."

First, what is known and what is not. Known: (1) the MPD published the method and two ways to spot it, and (2) the warning images show the envelope and the notice inside. Not known: how many letters were sent, whether anyone was harmed, or what the fake site's address is. The post does not say. So I do not claim any scale of harm; I give you how to spot it and what to do.

The "fake envelope" and "fake notice" the MPD showed

• ▸1. The fake envelope arrives. In the MPD image the brown envelope is printed with "Metropolitan Police Department Lost Property Center" and "112-0004, 1-9-11 Koraku, Bunkyo-ku, Tokyo", with "fake envelope" written over it in red. The address and the phone number printed on it match those on the MPD's official Lost Property Center page (checked by this site against the image and the page). Genuine contact details on the envelope do not make the letter genuine
• ▸2. You read the fake notice. The "lost property notice" inside says "an ID believed to be yours has been turned in as lost property and is being held at this center." The stored item is given as "My Number card", with a reception number, a reception date (30 September 2026) and a notice date (2 October 2026). "Fake notice" is written over it in red
• ▸3. You scan the QR code. The return procedure says to "check the MPD administrative procedures online page from the QR code" as the web procedure. As the phone procedure it says to tell them "a return notice for an ID has arrived" and give the reception number
• ▸4. You enter personal data. The MPD says the fake site makes you enter My Number and other personal information, and steals it. The fake site's screens and the fields it asks for are not published

How to spot it (the MPD's two points) and our additions

• ▸MPD point 1: "A letter that is mailed always carries a postage stamp." The fake-envelope image shows an envelope with no stamp on it (this site's check of the image)
• ▸MPD point 2: "Contact details never include a mobile phone number." The fake notice's inquiry section gives a staff name and a number starting with "070", a mobile prefix. It also lists reception hours ("weekdays 8:30 to 17:15"), which makes it look real (from the image)
• ▸Our addition: a correct name and address do not prove it is genuine. The fake envelope's address window carries the recipient's name and address (blacked out in the image). The MPD post does not say where the criminals got the address
• ▸Our addition: check the real center's phone number on the official page, not on the letter. The Lost Property Center's phone number and hours are on the MPD's official page (link below). Even if a number on the letter matches the real one, do not use it; open the official page yourself

What you can do today

• ✓★Do not scan the QR code on the letter. Do not call the phone number on it either. The number you "call to check" could be the criminals' mobile phone
• ✓Check for a stamp, and whether the contact details include a mobile number. If either applies, it matches the MPD's warning and is very likely not genuine
• ✓Consult your nearest police station about a suspicious letter. That is what the MPD asks. The consultation line is #9110 (non-urgent matters). Take the letter with you, do not throw it away (it is evidence; our addition)
• ✓If you are worried about a procedure, open the official page yourself. Use a bookmark or a search to reach the MPD's official site. Do not use QR codes or links in a letter or email. The MPD's QR-code page says the same: do not casually open links, check through the official site or app
• ✓Tell your family. Older relatives may believe a letter and may not see online news (our view). Send them the "three lines to send to family" below

If you already scanned it and entered data

• ▸1. Close the screen and stop entering anything. Note what you entered (My Number, name, address, date of birth, PIN, card number and so on) while you remember (our addition)
• ▸2. Consult your nearest police station or #9110. The MPD asks people to consult the nearest police station when a suspicious letter arrives. The post does not give steps for someone who has already entered data. Tell them about the letter and what you entered
• ▸3. If you entered your My Number card PIN or sent images of the card, consult the My Number general free dial. The Digital Agency page gives 0120-95-0178 (choose 2 at the voice guidance) for suspending the card's functions. That page does not describe this case; call to explain your situation as a consultation
• ▸4. If you entered a credit card number, contact the card company. If you entered the ID and password of another site, change the password on every service where you reuse it. This is guidance from the NPA's "Phishing countermeasures" page
• ▸For reference: My Number alone is not enough to complete procedures. The Digital Agency writes that "because procedures cannot be completed with the My Number alone, no one can extract information or misuse it immediately." That does not rule out misuse if it is stolen together with your name, address and date of birth (our view). This is why not entering it matters

If you may really have lost your ID

• ▸First check whether you still have the card. If you do, the letter does not match the facts
• ▸If you think you lost something, contact a police station or the Lost Property Center yourself. Check the contact details on the MPD's official page (for Tokyo: the Lost Property Center's number is 0570-550-142, weekdays 8:30 to 17:15, as stated on that page)
• ▸If you think you lost your My Number card, you can suspend it. My Number general free dial 0120-95-0178 (choose 2). The Digital Agency page says the suspension procedure is available 24 hours a day, 365 days a year

Spot-the-scam quiz

Imagine this.

Three lines to send to family

• ▸If a letter from the "Metropolitan Police Lost Property Center" says your My Number card is being held and tells you to use a QR code, do not scan it. Tokyo police warned on 8 October that it is a fake
• ▸★Two ways to spot it: a genuine letter has a stamp, and its contact details never include a mobile number. Do not call the number on the letter either
• ▸Take a suspicious letter to the nearest police station; do not throw it away. If unsure, call #9110; if money is being taken, call 110; for contract or billing trouble, the Consumer Hotline 188. (#9110, 110 and 188 are numbers inside Japan)

Where to get help

If you are unsure whether a suspicious letter is a scam, go to your nearest police station or call the police consultation line #9110 (Japan). Non-urgent consultations are accepted. If you are being robbed of money right now, call 110 (based on NPA guidance; our addition).
For contract or billing trouble, the Consumer Hotline "188" connects you to your local consumer center nationwide (Japan).
For lost or stolen My Number cards and card questions, call the My Number general free dial 0120-95-0178.

What I could not confirm

• ▸How many letters went where, and whether there was harm. The MPD post gives no counts or losses
• ▸The fake site's address and the fields it asks for. The post does not say
• ▸How the criminals obtained names and addresses. Not stated
• ▸Official step-by-step guidance for someone who already entered data. I checked the MPD post, the Digital Agency page and the NPA page, and found none that gives steps for this exact trick. The steps above combine what those pages say with our own additions
• ▸Whether the real Lost Property Center ever contacts people first by letter. The MPD's official center page (updated 30 August 2024) does not say whether the center initiates contact by letter or phone. The MPD says "a letter that is mailed always carries a postage stamp"

Pages this article is based on