Emails posing as the tax agency or points offers that push malicious apps onto Android

Short answer

If an email or text message tells you to install an app from a link, do not install it. Install apps only from the official app store. On 30 September 2026, Japan's Council of Anti-Phishing issued an urgent alert about emails that pose as the National Tax Agency and lead people to install malicious apps on Android, and it states that no e-Tax app for smartphones is provided. The weeks before year-end tax adjustment and tax filing are a time when messages about taxes are easy to believe.

What is happening

In its 30 September alert, the Council of Anti-Phishing lists emails with subjects such as a notice about a tax refund and a new message in your e-Tax message box. Earlier, on 8 September, it warned about emails posing as Rakuten Group and Rakuten Bank that use points, prize draws and coupons as a pretext to lead people to malicious Android apps. Some subjects even claimed the offer was for Android only.

In the council's monthly report for September (published 19 October), reports totalled 94,661, up 12,323 from August, and there were 49,032 phishing site URLs. The report says emails disguised as app updates or application procedures that lead to malicious apps have increased sharply, as have emails leading to tech support scams.

From "type it in" to "install this app"

The best-known approach has been fake sites that ask you to type in your ID or card number. This approach targets Android users and tries to get them to install an app. An app stays on the device after it is installed, so closing a fake site is not the end of it.

The National Tax Agency says it never sends text messages containing URLs, and never sends emails or text messages requesting tax payment or about seizing assets. To check e-Tax notices, open your message box the way you usually do, not from a link in an email.

What you can do yourself

Google's Pixel help says that installing apps from unknown sources can put your phone and personal data at risk. You can turn the permission off for each app under Settings, Apps, Special app access, Install unknown apps. The wording differs by manufacturer. If you handle year-end tax adjustment at work, add a line to your notice saying that neither the National Tax Agency nor e-Tax will email staff asking them to install an app. It saves people from guessing.

If you installed one

For example, suppose you installed an unfamiliar app from a link in an email. First turn off Wi-Fi and mobile data, then delete the app. If it cannot be deleted, ask the phone maker or your mobile carrier for help. Next, use a different device to change the passwords for the services you used on that phone, including any other accounts that share the same password. If you used banking or card apps, contact your bank or card issuer using the number on the back of your card or on their official website.

If the problem is not solved

If you are worried about damage or have already paid money, you can call #9110 (in Japan), the police consultation line listed by Japan's National Police Agency, or 188 (in Japan), the Consumer Hotline run by the Consumer Affairs Agency. Use numbers you have confirmed in official information, never a number found in the email. You can report similar emails through the reporting contact on the Council of Anti-Phishing's website.