LinkT&B Editorial Department
Multi-factor authentication improves on passwords alone, but codes entered into a phishing site can still be stolen. Evaluate phishing resistance together with account recovery when a device is lost.
Contents
- Review authentication and recovery together
- Background/Threat trends
- AiTM (Adversary-in-the-Middle) attacks take advantage of MFA "input"
- The Financial Services Agency's tightening of MFA regulations has entered the stage of questioning the "quality of the method"
- SIM swap is not the only limitation of SMS authentication
- Technical knowledge/main theory
- MFA method comparison table
- Why FIDO2/Passkey is effective
- It is realistic to implement the process step by step, starting with important operations.
- Summary
- Consultation
- Related Articles
- Discuss your project
According to the Financial Services Agency's provisional tally updated on March 9, 2026, there were 11,444 cases of unauthorized access to securities accounts and 6,499 cases of fraudulent transactions from January to May 2025, with sales amounting to approximately 295.3 billion yen and purchases amounting to approximately 260.4 billion yen. Moreover, these amounts are not the actual amount of customer losses, but the total amount of fraudulent transactions. The question now is not "Have you installed MFA?" but "Will your MFA be able to withstand phishing?" (Financial Services Agency “Please be careful about unauthorized access and transactions to internet transaction services” updated on March 9, 2026)
Review authentication and recovery together
| Item | What to check | How to assess it |
|---|---|---|
| Sign-in | Support for passkeys or other methods | Compatible devices and user groups |
| Sensitive actions | Withdrawals, permission and data changes | Reauthentication and audit trails |
| Recovery | Loss, replacement and support | Avoid a weaker recovery bypass |
Background/Threat trends
AiTM (Adversary-in-the-Middle) attacks take advantage of MFA "input"
AiTM attacks, which have been increasing in recent years, insert fake websites between users and genuine services, and relay not only IDs and passwords, but also SMS and authentication app one-time codes, and even session information after login in real time. Microsoft explains that AiTM-style credential phishing is on the rise as MFA becomes more popular, and reports that open source phishing kits like Evilginx are amplifying its impact. Okta also describes EvilProxy as a reverse proxy-type PhaaS (Phishing-as-a-Service) that can steal authentication information and valid session cookies and bypass MFA. (Microsoft Security Blog, Okta Threat Intelligence)
The Financial Services Agency's tightening of MFA regulations has entered the stage of questioning the "quality of the method"
In June 2025, the Financial Services Agency stated that in addition to ID/password authentication to prevent unauthorized access to securities accounts, “one-time passwords via email or SMS messages alone are not very effective against modern phishing,” and that strong multi-factor authentication such as passkeys is required. Furthermore, on October 15, 2025, the "Comprehensive Supervisory Guidelines for Financial Instruments Business Operators, etc." will be amended and enforced, and phishing-resistant multi-factor authentication will be implemented for important operations such as login, withdrawal, and changing the bank account for withdrawals in internet transactions at securities companies, etc., and will be made mandatory by default in principle. In principle, the Financial Services Agency requires implementation by the end of June 2026, and although this is not a "uniform legal obligation for all companies," it does mean that, at least in the financial sector, "which MFA to use" has become an important supervisory issue. (Financial Services Agency, “Notifications from the Opinion Exchange Meeting on Financial Crime Countermeasures with New Type Banks,” June 2025, Financial Services Agency, “Comprehensive Supervisory Guidelines for Financial Instruments Business Operators,” Financial Services Agency, “Main Points Raised by the Financial Services Agency at the Opinion Exchange Meeting with Industry Associations,” November 18, 2025)
SIM swap is not the only limitation of SMS authentication
Because SMS authentication uses the "possession" factor, it falls under multi-factor authentication by definition. However, IPA warns that there is phishing that targets one-time passwords sent via SMS. NIST SP 800-63B-4 also restricts out-of-band authentication using PSTN and does not treat OTP or out-of-band authentication as phishing-resistant. The reason is simple: if a user enters the code they see on a fake site, an attacker can transfer the value to the real site. The National Police Agency has also confirmed that SIM swapping was used as a method to evade SMS authentication, and although damage has decreased in Japan after strengthening countermeasures, it cannot be said that SMS is a structurally strong method. (IPA “Top 10 Information Security Threats 2025: Terms and mechanisms you need to know”, NIST SP 800-63B-4, National Police Agency “Report of the Study Group for Ensuring Safety and Security in a Cashless Society”)
Technical knowledge/main theory
MFA method comparison table
The table below provides a relative evaluation of the three methods that are most likely to be adopted by companies. Security strength is an evaluation based on phishing resistance, and installation cost and user experience are guidelines for general corporate implementation. It depends on your existing IdP, device management, and help desk structure. (NIST SP 800-63B-4, IPA, Financial Services Agency)
| Technology | security strength | Introduction cost | user experience | Phishing resistance | How to use it |
|---|---|---|---|---|---|
| SMS authentication | limited | Low | Medium (requires SMS reception and code entry) | None | Alternatives during transition period, exception handling |
| TOTP authentication app | Medium to high | Medium | Medium (app confirmation and code input required) | None | Supplement for employees during transition period of existing SSO/VPN |
| FIDO2/passkey | High | Medium | High (easy to complete with face, fingerprint, or PIN) | Yes | Standard candidates for customer login, employee SSO, and administrator authentication |
What is important here is that among the three methods compared in this article, only the FIDO2/WebAuthn system meets the phishing resistance defined by NIST. NIST clearly states that methods that require humans to read and enter codes, such as OTP and SMS, are not phishing-resistant, and AAL2 should also provide at least one phishing-resistant option. On the other hand, WebAuthn has a mechanism that cryptographically links authentication results to legitimate domains. Although there are other methods that are phishing-resistant, such as PKI-based client authentication, FIDO2/Passkey is the most representative method that is easy to widely implement for web services. (NIST SP 800-63B-4, Financial Services Agency, Japan Securities Dealers Association)
Why FIDO2/Passkey is effective
IPA explains that passkeys are difficult to reuse because they use public key cryptography, do not store passwords on the server, and use authentication data that changes each time. Furthermore, the device's biometric authentication and PIN are used locally to unlock the device, so even if you enter the PIN through phishing, that value does not become the service's authentication secret. IPA points out that passkeys are resistant to SIM swapping and SMS authentication breaches, and that passkeys themselves can function as multi-factor authentication by combining possession of a device with a biometric/PIN. (IPA “Top 10 Information Security Threats 2024 Manual”, NIST SP 800-63B-4)
It is realistic to implement the process step by step, starting with important operations.
The first step is inventory. On the customer side, log-in, remittance/withdrawal, change of transfer or withdrawal destination, change of personal information, etc. are identified. On the employee side, prioritize email, SSO, VPN, privileged IDs, admin consoles, and vendor-maintained remote connectivity. The Financial Services Agency's Guidelines for Cybersecurity in the Financial Sector also require the use of multi-factor authentication and encrypted connections for remote access to critical systems. (Financial Services Agency “Guidelines for Cybersecurity in the Financial Sector”)
The second step is to prioritize FIDO2/passkey from important operations. You don't have to replace everything at once. First, switch to areas where the amount of damage and risk of horizontal spread is large, such as privileged IDs, accounting approvals, administrators, and important operations for Internet transactions. SMS and TOTP are effective as an alternative means during a transition period or as an exception response, but it is better to design a system that can be gradually reduced rather than being set as the final destination. (Financial Services Agency, Japan Securities Dealers Association, NIST SP 800-63B-4)
The third step is to not stop at "just" authentication. The Financial Services Agency is requesting that users refrain from easily posting login links and password entry page URLs in emails and SMS, encourage users to log in from bookmarks and legitimate apps, introduce sending domain authentication, request the closure of phishing sites, and strengthen login notifications, account locks, and behavior detection. AiTM targets not only the moment of authentication, but also the subsequent session abuse, so corporate phishing countermeasures must be designed to integrate authentication, detection, and recovery. (Financial Services Agency “Comprehensive Supervisory Guidelines for Financial Instruments Business Operators, etc.”, Microsoft Security Blog)
The fourth step is designing exceptions and recovery flows. If you don't plan ahead, your work will stop if you don't plan ahead for users who don't have smartphones, replacing their devices, re-registering them when they're lost, and verifying your identity at the help desk. The Japan Securities Dealers Association's practice guidelines also call for customers who cannot use phishing-resistant multi-factor authentication to be provided with alternative MFA, and to be reviewed based on the revocation rate. A migration roadmap is only complete when it includes not only technology selection but also exception rate and operational load management. (Japan Securities Dealers Association "Guidelines for preventing unauthorized access in Internet transactions", NIST SP 800-63B-4)
Summary
What we need now is to abandon the self-evaluation that we have “already implemented MFA.” SMS and TOTP are definitely more secure than passwords alone. However, since the Financial Services Agency itself has clearly stated that “one-time passwords for email and SMS alone are not sufficient for modern phishing,” the roadmap for companies and financial institutions should proceed in the following order: (1) inventory of important operations, (2) making SMS/TOTP an exception, (3) standardizing FIDO2/passkeys, and (4) developing notification, detection, and recovery systems. MFA is not just a matter of installing it; it must be used as an authentication infrastructure that is continually updated in line with attack methods. (Financial Services Agency, NIST SP 800-63B-4, IPA)
Consultation
Have you checked how well your company's authentication infrastructure can withstand today's phishing and AiTM attacks? At LinkT&B, we support security diagnoses, including taking inventory of authentication methods, identifying important operations, and designing priorities for passkey migration. For more information, please see Service page, and for individual consultation, please see Contact us.
Related Articles
How Safe Is Cloud AI Data? The Case for Local LLMs
Practical Cybersecurity for Small and Medium-Sized Businesses
:Discuss your project
We support website security, monitoring and maintenance. Tell us about your current setup and the operational work you need to improve.