[A Bank Robocall to Your Company?] "Your PC Needs Updating" Is a Scam | Japan's NPA Announced a Joint Probe With Vietnam on 13 October

Hello! I'm Shemhazai, the sentinel.
Today: what to do when an automated call posing as a bank reaches your company or shop.

The short answer: if a bank calls you, do not carry on. Hang up, then call the bank's branch or main number yourself to check. And never open links in mail or SMS posing as a bank. This is especially for people who handle accounting, sole proprietors, and families who run a shop or company.

Today's example. In a press document dated 13 October 2026 the National Police Agency (NPA) announced that, in a bank-impersonation voice-phishing case that began in October 2024, Japanese police arrested a suspect who acted as intermediary with a Vietnamese money-laundering group, passed the findings from seized evidence to Vietnam, and seven suspects were arrested in Vietnam (a joint investigation).

The NPA also warns that the method has changed and the losses are returning. Its first-half 2026 threat report says that from autumn 2024, crime groups phoned companies, posed as handling an online-banking update, got an email address out of them, and sent phishing mail — a voice-phishing method behind a surge in fraudulent transfers from business accounts. From May 2026, losses surged from a new method that has the victim install remote-control software.

First, what is known and what is not. Known: the flow and countermeasures the NPA describes, the first-half 2026 count and amount, and that arrests were made in the joint investigation. Not known: the latest figures. The NPA's published numbers run only to the first half of 2026 (to the end of June), and I could not find numbers from July onward (see "What I could not confirm").

From the phone call to the transfer

• ▸1. An automated call arrives. The NPA's example: "This is XX Bank. If you use online banking, press a number." Its figure notes the call comes from an international number
• ▸2. After you press a number, a human voice takes over. It says "Your PC environment needs updating. To proceed, please tell us your email address and mobile phone number."
• ▸3. You are made to open a link. The NPA lists two ways: a link in a fake email gets you to install remote-control software described as a "security-strengthening tool"; and a link in an SMS leads to a fake site that steals the online-banking ID and password
• ▸4. Money moves behind a fake screen. While a fake screen such as "system updating" is shown on the remote-controlled company computer, the stolen ID and password are used for the fraudulent transfer
• ▸Why remote control? The NPA writes that by sending money from the computer the company normally uses, the criminals are thought to be trying to avoid the bank's device authentication and fraud monitoring

What you can do today

• ✓★If a bank phones you, hang up first. Then call the bank's branch or main number yourself to check it is genuine (NPA). Use a number you looked up yourself, such as in your passbook or on the bank's official site (how to look it up is our note)
• ✓Do not open links in mail or SMS that pose as a bank. The NPA says access is "prohibited"
• ✓If told "your PC needs updating" or "install this security software", do not. Remote-control software hands your screen and controls to the other side (our note)
• ✓Do not give your email address or mobile number to a caller. In the NPA's flow, the fake email is sent from there
• ✓Share this beyond the accounting or admin staff — with colleagues and family. The NPA letter says to "make it thorough inside the company to prevent harm before it happens"
• ✓Consider blocking incoming international calls. The NPA recommends it as an anti-fraud measure; the NPA page explains how to apply to suspend international calls on a landline

If you already gave an ID or password, or installed the software

• ▸1. Cut the connection. Take the computer off the network (unplug the LAN cable, turn off Wi-Fi). Whether to power it off is something to ask a specialist about first (our note)
• ▸2. Phone your bank right away. Again, use a main number or branch you looked up yourself. Ask about suspending online banking and checking for unauthorised transfers (our note)
• ▸3. Report to or consult the police. The NPA writes "if you do fall victim, report to or consult the police": your nearest police station or the cybercrime consultation desk
• ▸On 30 September 2026 the NPA announced that it widened to 20 partner banks the framework in which police and financial institutions trace, freeze and recover the proceeds of special fraud (operating from 1 October). Even after money has moved, acting quickly leaves more to work with (our note; the NPA material does not say whether this framework applies to this voice-phishing method)
• ▸The NPA letter gives no concrete procedure for steps 1 and 2. They are our notes

Spot-the-scam quiz

Picture this.

Three lines to send your family or colleagues

• ▸An automated call saying "This is XX Bank; press a number if you use online banking" is the entry point of a scam aimed at business accounts. If you are told "your PC needs updating", it is a scam (NPA)
• ▸★Hang up, then call the branch or main number you looked up yourself, in your passbook or on the official site. Do not open links in mail or SMS posing as a bank
• ▸If you installed software, gave an ID or password, or fear money has moved, call your bank and the police at once (nearest station or cybercrime desk; #9110 if unsure)

Where to get help (Japan)

If you are not sure whether something is a scam, or you may have been a victim, contact your nearest police station, the cybercrime consultation desk, or the police advice line #9110. If money is being sent right now, call 110 (based on NPA guidance; our note). These are services within Japan.

For contract or billing trouble, call the Consumer Hotline 188. It connects you to your local consumer affairs centre.

What I could not confirm

• ▸Current loss counts and amounts. The NPA's figures cover the first half of 2026 (to the end of June): 253 online-banking fraudulent transfers, about 2.07 billion yen, down 51 percent. I could not find counts or amounts for the remote-control method alone, which surged from May 2026
• ▸Whether the same method is used against personal accounts. The NPA material describes attacks on business accounts. I did not confirm cases aimed at individuals
• ▸What the joint investigation found beyond the headline. The 13 October release says Japanese police arrested an intermediary and seven suspects were arrested in Vietnam, but it gives no loss amount, no group size and no link to the methods still in use
• ▸The announcement date. The document is dated 13 October, but the NPA site lists it under 14 October. This article uses the document date, 13 October
• ▸The NPA letter gives no concrete steps for right after an attack. "Cut the connection" and "phone your bank" are marked as our notes
• ▸Whether the freezing framework applies to this voice phishing. The NPA material describes a framework for the proceeds of special fraud and does not say it covers this method

Pages we relied on