In Japan, two individuals were arrested under suspicion of committing fraud involving Rakuten Mobile's eSIM contracts. A 20-year-old technical college student from Asahikawa, Hokkaido, and a 19-year-old unemployed individual from Nerima, Tokyo, are believed to have fraudulently obtained IDs and passwords of legitimate customers and used them to contract multiple eSIM lines. They reportedly confessed to the allegations. According to investigators, the suspects exploited Rakuten’s policy that allows up to 10 lines to be contracted under a single account, allegedly signing up for as many as 1,000 lines from August to October of the previous year.

The investigation revealed that the unemployed suspect created a website that misleadingly presented Rakuten's system, facilitating the easy addition of eSIMs if users input their ID and password. This fraudulent system mimicked the process necessary for obtaining legitimate SIM cards. Furthermore, it is believed that the suspects acquired over 5 million IDs and passwords from international sites to conduct their scheme. Earlier in February of this year, they had already been arrested for similar charges, including electronic fraud and illegal access to computer networks, indicating a pattern of illegal activities including the management of stolen credentials for other services.

The suspects initially met online, participating in cybersecurity competitions where they showcased their technical skills, which raises concerns about the potential misuse of such expertise for malicious purposes. The case has broader implications for telecommunications security and highlights the vulnerabilities in identity protection measures that can be exploited by technologically adept individuals.