A phishing email posing as Saison Card and warning of an unfinished ¥254,100 purchase on Mercari has been traced to Arara Message, a bulk email service run by Tokyo-based Arara Inc., after the company disclosed unauthorized access to its systems.
The message reached a member of the Japan Fact Check Center's editorial team on October 29. The sender name read "Saison Card" and the subject line "Request to confirm usage details." The body carried the Saison Card logo, the headings "CARD USAGE NOTICE" and "Confirmation of usage," the merchant "Mercari" and the amount "254,100 yen."
A button at the bottom read "Answer your usage confirmation here (about 30 seconds)." The email uses a large charge to alarm the recipient into pressing the link, the center reported. Similar messages appeared on X in late October, some naming Yodobashi Camera or Rakuten Ichiba as the merchant instead of Mercari.
A genuine domain behind the fake sender
The sender address on the email was [email protected]. Arara.com is the domain of Arara Inc., which runs the Arara Message distribution service for corporate announcements and newsletters.
Arara disclosed unauthorized access to the service on October 29 and again on November 2. Up to about 7.13 million suspicious emails impersonating credit card companies were sent, with subject lines including "Request to confirm usage details," Jiji Press reported. The breach exposed 7.7 million email addresses, including 100,000 belonging to Suntory employees and others, according to Jiji.
Arara suspended all of the service on October 31. The company urged recipients of unexpected messages not to open any listed URL, reply, open attachments or enter IDs, passwords or personal information, and to delete the email.
Because the phishing mail appears to have gone out through Arara's legitimate domain and delivery service rather than a lookalike address, recipients have little to flag it by. A strange domain is an easy warning sign; a real company's domain is not.
Saison Card has warned before
Saison Card has warned on its website that phishing emails posing as the card issuer have been confirmed, citing subject lines about usage confirmation, point expiry and card renewal, and urged customers to check the sender address and avoid entering personal information through links.
The center's advice is to check usage through a card issuer's official app or a bookmarked official site rather than through a link in an email. The verification was by Shunsaku Kiyama and edited by Kamome Fujimori and Daisuke Furuta.