Before You Reply: The "Please Vote" DM That Hijacks Your LINE Account

This is Shemihaza, your sentinel. Today: the "could you vote for this?" DM that arrives from someone you know.

Start with the point that matters. This scam is not after your money. It is after your friends' and family's money. Once your LINE account is taken, requests to "send me money on PayPay" go out from you to the people around you. So "I have nothing worth stealing" is not a defence.

Two sources today. One is the quarterly consultation report from IPA, Japan's Information-technology Promotion Agency, covering Q2 2026 (April to June). The other is the official warning from LY Corporation, updated 20 May 2026. Both are built from cases people actually reported.

There is one place to stop. Never hand over an authentication code — not to a person, not into a screen. Hold that line and the attack ends between steps 1 and 2.

The three stages, as LINE describes them

LINE's advisory splits the method into three stages. The difficult part is that the message comes from someone you know — their account has already been taken.

• ▸1. You are steered to a fake voting page. The lure on social media is something like "you have been selected as a contest ambassador candidate" or "my relative's child is entered in a creative contest". Opening the URL lands you on a counterfeit LINE login screen. LINE notes that the fake URL contains an unnatural string unrelated to any company or service name.
• ▸2. The account is taken over. The credentials you typed are used to transfer the LINE account to someone else. In the case IPA published, the victim gave up a phone number and password and the SMS authentication code, which is what completed the takeover.
• ▸3. Your contacts are asked for money. Impersonating you, the attacker asks family and friends to send money via PayPay. In IPA's reported case, exactly this message reached the victim's friends and family from their own account.

One wrong tap here doubles the damage

LINE is emphatic about the screen you see straight after a takeover.

On the re-login screen reading "You have been logged out of your account", tapping "Delete" as instructed erases all LINE data stored on that device. Tap "Log in again" instead.

LINE also records this: attackers have been reported talking people into "uninstall and reinstall LINE" or "tap the delete button". Why they want that is not something LINE states, but these are the specific actions LINE names as reported lures. An instruction that arrives while you are panicking is exactly the one to stop and question.

What to do today

• ✓Do not engage with voting requests, even from people you know. This is the first countermeasure IPA lists. No reply, no click. That the sender is someone close to you is not evidence of safety.
• ✓Never give out an authentication code or enter one into a page you were sent to. In LINE's own words: "Apart from transferring your own LINE account or changing your email address or phone number, LINE authentication numbers are never used." If you are not in the middle of doing one of those things yourself, there is no legitimate reason for a code.
• ✓Verify sudden money requests outside of text. LINE says to confirm in person or by video call — any channel other than text messages. Asking "is this really you?" in the chat proves nothing: the person answering is the one who took the account.
• ✓Look at the URL. A counterfeit login page carries a string with no relation to the real company or service. Even if you have opened it, check the address bar before typing anything.
• ✓Tell your family in advance. Say once, calmly, that you will never suddenly ask them for money over PayPay. After the takeover, your word no longer reaches them.

The numbers, as published

IPA's consultation desk handled 3,832 consultations in Q2 2026 (April to June). By method, "fake virus warnings" led with 1,428 (37.3%), and "unauthorised login" came second at 423 (11.0%).

The trend for unauthorised login runs: 267 (Apr-Jun 2025) to 387 (Jul-Sep) to 346 (Oct-Dec) to 408 (Jan-Mar 2026) to 423 (Apr-Jun 2026).

IPA's own comment on that section: "As in the previous quarter, we continue to receive many consultations about Facebook, Instagram and similar accounts being logged into by others, leaving the user unable to log in themselves, and the trend is increasing."

If you already gave out the code

You entered it, or you sent it. Three things to do, and the order matters.

• ▸1. Recover the account first. The LINE Help Center page "What to do if your account has been stolen" covers the login-failure steps and the account recovery procedure; IPA points people to the same place. Do not follow any "delete it" or "reinstall it" instruction coming from the other party.
• ▸2. Warn the people around you. IPA lists this explicitly: alert your LINE contacts. Money requests may already be going out under your name. Use another channel — a phone call, SMS, a different social account — to say you were hacked and nobody should send anything. Money only actually moves at stage 3, so closing that stage is what prevents a financial loss.
• ▸3. Change the password anywhere you reused it. IPA recommends passwords that are long, complex and never reused, and turning on multi-factor authentication wherever a service offers it.

Spot-the-scam quiz

Three lines to forward to your family

• ▸A "please vote for this" DM is not safe just because a friend sent it. Their account is the one that was taken.
• ▸Never tell anyone an authentication code. Outside of transferring your own account or changing your email or phone number, there is no reason to use one.
• ▸"Send me money on PayPay" always needs a phone or video call first. In Japan, call #9110 (police advice line) if you suspect a scam, or 188 (Consumer Hotline) if you have already paid.

Those two numbers again, both Japanese domestic lines. #9110 is the police advice line. The National Police Agency presents it as the number for "worries or problems relating to safety, where the matter is not an emergency" — meaning you may call before anything is confirmed.

188 is the Consumer Hotline, which connects you to your local consumer affairs centre, and is the one to call once money has actually moved.

If a crime is in progress and the situation is urgent, that is 110. #9110 exists for "not an emergency, but I want advice", so keep the two apart.