Minors use generative AI to exploit Rakuten Mobile authentication system
Three middle and high school students in Japan were arrested for using a generative AI-created program to fraudulently access Rakuten Mobile's system and contract over 1,000 mobile lines, which they then resold. The program included anonymization features to evade tracing and obtained approximately 75 million yen in cryptocurrency from the scheme.
What happened
Three middle and high school students—a 15-year-old from Shiga Prefecture, a 16-year-old from Gifu Prefecture, and a 14-year-old from Tokyo—were arrested for using a generative AI-created program to fraudulently access Rakuten Mobile's authentication system.
The program, primarily developed by the 16-year-old from Gifu Prefecture, automatically input stolen usernames and passwords to attempt unauthorized logins, then automatically completed mobile line contracts once access was gained.
The three suspects obtained over 1,000 mobile line contracts through this method and resold them for approximately 75 million yen in cryptocurrency. The program included anonymization features designed to obscure the origin of communications and prevent tracing of the unauthorized access.
Reported impact
Rakuten Mobile's authentication system was compromised, and unauthorized mobile lines were fraudulently contracted and resold to other parties, potentially facilitating further criminal activity.
Index analysis
The suspects, who met through online gaming, used encrypted messaging application Telegram for communications about the scheme, leveraging its message auto-deletion feature. They targeted Rakuten Mobile's authentication system specifically to obtain mobile lines for resale.
Governance controls
The Tokyo Metropolitan Police Department detected and investigated the unauthorized access under the Computer Fraud Prevention Act and arrested the three suspects. Investigators noted that the perpetrators deliberately incorporated anonymization features into the program to evade detection.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.