You are still in time. What matters is not that you typed it in — it is what you do in the next ten minutes. Let us go through it together, in order.
Do this now, from the top
- 1
Work out what you actually entered
Who you contact depends on whether it was a card number, a bank PIN, or a service ID and password. If it was more than one, deal with the things tied directly to money — card and bank — first.
- 2
Card number → phone your card issuer now
Call the number printed on the back of the card and say you entered your card number on a phishing site. They will freeze the card and reissue it. Most issuers take these calls 24 hours a day. Fraudulent charges are normally covered, so you can make this call calmly.
- 3
Bank details → phone your bank now
If you entered online banking credentials or a PIN, call your bank's lost-and-stolen line and ask them to suspend the account or reset the password. Check your statement or app for withdrawals you do not recognise.
- 4
Password → change it from the real site, right now
Do not use the link from the message. Open the official app, a bookmark, or search for the site yourself, then change the password. If you reuse that password anywhere else, change it there too — attackers try stolen passwords on other services immediately.
- 5
Turn on two-factor authentication
While you are changing the password, enable two-factor authentication (a code sent to your phone at login). Even if your password has already leaked, this stops the login.
- 6
Watch your statements for the next month or two
Check your card and bank statements periodically for charges you do not recognise. Some fraud starts with a tiny test payment of a few hundred yen. If you spot one, contact your card issuer or bank straight away.
⚠ And what not to do
- ✕Do not go back to the fake site to "check" it — you would only hand over more information
- ✕Do not change your password through a link in the email or SMS you received; always use the official app or a bookmark
- ✕Do not put it off because you feel it was your fault. Time is the thing working against you
Who you can call
No area code needed. Connects you to your nearest consumer affairs centre in Japan.
For non-emergency matters. They can also tell you whether it is a criminal case. Call 110 if it is an emergency.
Technical questions about malware infections and unauthorised access.
The phone numbers on this page are services within Japan. If you are elsewhere, contact your national consumer protection agency, your bank or card issuer directly, and your local police non-emergency line — the steps above still apply.
💬 Worth talking about at home today
Something to say at home: "If you ever type something into a strange site, I will not be angry — just tell me straight away. If you tell me early, we can always fix it."