JP — ITmedia
Phishing Emails Posing as Ticket Lottery Winners Surge: Tactics Impersonating e+, Lawson Ticket and Pia — We Asked Phishing Experts for Countermeasures
Security2 min read
Scam emails that pretend to be ticket sites are rising fast in Japan. They say you won a lottery and ask you to pay, but the links lead to fake pages that steal login details and personal data.
Fake ticket-win emails are spreading
Scammers are sending emails that look like they come from ticket sites such as e+ (Eplus), Lawson Ticket, and Ticketpia. The emails say you won a lottery for a show or event and ask you to pay within a short time. The payment links do not go to the real e+ website. They go to a cloud server address on Amazon Web Services (AWS). Many users posted about these emails on X (formerly Twitter) from about October 20.
Key numbers
- Reports of e+ phishing rose from 85 in the week from September 19 to 552 in the week from October 10, about 6.5 times more.
- Ticketpia phishing reports stayed between about 110 and 160 per week.
- Lawson phishing reports reached 65 in the week from October 10.
- The Anti-Phishing Council says these numbers are small compared with all phishing, but the rise is clear.
- The Spam Mail Consultation Center listed more than 10 fake emails from the three companies in one week (October 13 to 19).
How these scams work
Phishing means tricking people into going to a fake website. There, they are asked to enter an ID, password, or personal details, which the scammers steal. Some emails claim you won a prize and must pay a system fee. Others say you did not pay an entry fee, ask you to re-verify your account, or say your ticket was cancelled and you must act fast. Some emails copy the company's own email domain name, so checking the sender is not always enough.
Why it matters
Ticket fans often enter lotteries and feel excited about a win, so they may click quickly. The Anti-Phishing Council says most people cannot tell fake emails from real ones. Clicking a link is the main risk, so the safest step is not to open links in emails or texts at all.
What to watch and what to do
- Do not click links in emails or text messages about tickets or payments.
- Open ticket sites through their official app or saved bookmarks instead.
- If you typed a password on a fake site, change it right away.
- If you entered card details, ask your card company to stop the card and issue a new one, then check for unknown charges.
- If personal information was entered, contact the police if you later see misuse.