Fake "Please Confirm Your Payment Method" Emails: Japan's NPA Warning of 15 October — Don't Click, Don't Reuse Passwords, Use Passkeys

Hello! I am Shemihaza, the sentinel.
Today: the fake email that says "For your delivery, please confirm your payment method."
The short answer: do not tap the link in the email. Open the site yourself from a bookmark or the official app.

Today's real example. On 15 October 2026 Japan's National Police Agency (NPA) issued Cyber Police Agency Letter Vol.20, "Beware of phishing emails!" A red box at the top says: "Fake emails sent to leaked email addresses can lead to further information leaks and financial loss." The same day the NPA also announced that, working with Microsoft and the Japan Cybercrime Control Center (JC3), a takedown of criminal infrastructure used for phishing had been carried out.

First, what is known and what is not. Known: (1) the NPA published an example fake email and three protections, and (2) it published the dates of the takedown (lawsuit filed 6 October, court order 8 October). Not known: whether this takedown reduces the fake emails that reach Japan. The NPA material does not say. So keep your habits unchanged.

The fake email example the NPA showed

• ▸1. A fake email arrives. The NPA's example is titled "Important notice from your account." The sender looks official ("official mail"), and the NPA notes the sending address may also be forged
• ▸2. You are told to confirm your payment method and tap a link. The example body is only "For your delivery, please confirm your payment method" and a link. A delivery gives a reason to think you must confirm (our reading)
• ▸3. You type details into a fake site. The page says "Enter payment method" with fields for the cardholder name and the card number. Whatever you type here is stolen (the NPA's example)
• ▸4. Your information is stolen. The NPA says it can lead to further leaks and financial loss. Its "Phishing countermeasures" page lists, among the information fake sites ask for, card numbers, PINs, IDs, passwords, addresses, names, phone numbers and dates of birth

Do not try too hard to spot the fake. On its phishing page the NPA says the sender name and address shown in your mail app are easy to change, so judging by appearance alone is difficult. It adds that smartphone screens show fewer items, making it harder still. So protect yourself by not tapping, not by inspecting.

What you can do today: the NPA's protections

• ✓★Do not casually click links in email. For payment, account or delivery notices, open the official site from a bookmark you saved earlier, or the official app. The NPA says links can be forged and look-alike domains are common, so judging a link by looks is extremely difficult
• ✓Do not reuse IDs and passwords. If you use the same pair on several sites, one theft can take over your bank, social media and shopping accounts (NPA). If you cannot remember them, use a password manager
• ✓Use passkeys or other multi-factor authentication. Even if the password is stolen, it alone is less likely to let someone in. The NPA also recommends one-time passwords and fingerprint or face authentication. One service at a time is enough
• ✓Turn on spam and message blocking. Mobile carriers and others offer functions that make phishing emails and suspicious text messages harder to receive (NPA)
• ✓Keep your OS and apps up to date. Fake sites can be reached through ads that exploit flaws, so update to stay safe (NPA)

If you already typed in card details or a password

• ▸1. Contact the company behind the affected service right away. A bank for unauthorized transfers, the card company for unauthorized card use. Some offer compensation schemes and help desks (NPA). Use the number on the back of the card or on the official site, not a number from the email (our addition)
• ▸2. Change the password on every service that uses the same ID and password. If you reused the password you typed in, that means all of them (NPA)
• ▸3. Report to or consult the police. Use your nearest police station or the online window for cyber incidents. If you find a fake site, you can report its URL to "Phishing 110" (NPA)
• ▸4. Check your statements daily for a while for charges you do not recognize (our addition)

The takedown announced the same day

The NPA's press material (October 2026) gives this sequence. From October 2025, the Kanto Regional Police Bureau's Cyber Special Investigation Unit, Microsoft and JC3 worked to uncover how phishing aimed at Japan operated and identified the criminal infrastructure behind it. On the 6th of this month Microsoft and others filed suit in a US court; on the 8th the court issued an order and the takedown was carried out.

• ▸Per press reports (relaying Microsoft's announcement): The Record and CyberScoop (both dated 14 October 2026) say Microsoft targeted three services, "YAM Store," "CoGUI" and "Iron Man." They report more than 1 billion emails and text messages and more than 75,000 organizations targeted, and say some of it was used against people in Japan
• ▸Example lures (press): an undeliverable package, an unpaid toll, a bank account needing attention, an overdue tax bill. Like the NPA's example, they push you to "pay or confirm" (our reading)
• ▸Limits of this article: the NPA material does not name the services or give counts. I could not open Microsoft's own announcement. The names and numbers above are copied from press reports

A takedown does not change how you protect yourself. The same day, alongside the takedown notice, the NPA issued the "do not casually click links" warning. Taking one channel away may not stop senders from using another (our reading; the public material does not say whether they moved).

Spot-the-scam quiz

Imagine this.

Three lines to send to family

• ▸Suspect any email like "For your delivery, please confirm your payment method." Do not tap the link; open the site yourself from a bookmark or the official app (NPA, 15 October)
• ▸★If you typed in card numbers or a password, contact the card company or bank at once. Use the number on the back of the card or on the official site, and change the password on every service where you used the same one
• ▸If unsure, call #9110; if money is being taken, call 110; for contract or billing trouble, the Consumer Hotline 188. (#9110, 110 and 188 are numbers inside Japan)

Where to get help

If you are unsure whether something is a scam, call the police consultation line #9110 (Japan). Non-urgent consultations are taken at your nearest police station or through #9110. If you are being robbed of money right now, call 110 (based on NPA guidance; our addition).
For contract or billing trouble, the Consumer Hotline "188" connects you to your local consumer center nationwide (Japan).
If you find a fake site, you can report its URL to "Phishing 110," as the NPA points out.

What I could not confirm

• ▸Whether this takedown reduces the fake emails that reach Japan. The NPA material does not say. This article does not claim it will or will not
• ▸The names of the services taken down, or counts and losses in Japan. The NPA material has none. The names and numbers above are from US press reports, which differ on the number of fake page templates (over 2,300 versus 2,360), and I could not confirm Microsoft's own announcement
• ▸Whether the NPA's example is a specific email now in circulation. The NPA shows it with placeholders ("●●", "example") and names no real brand
• ▸The content of the 8 October issue (Vol.19, "Beware of information leaks"). I saw the title but did not read it, and did not rely on it

Pages this article is based on