TL;DR
- 01What happened
On March 19, 2026, ZUU, listed on the Tokyo Stock Exchange Growth market, received a transfer instruction in its business chat from someone posing as an executive and paid ¥96 million to an outside account the same day. The company disclosed that the payment followed its existing rules and processes. It requested a recall and filed a police report, but called recovery extremely difficult.
- 02Why it went through
The later special investigation cited poor understanding and application of the rules, and ZUU itself cites insufficient authenticity checks where the chat tool meets the payment process. Rules alone do not stop a disguised instruction if nothing checks where it came from.
- 03The missing layer
ZUU suspected the instruction soon after paying and acted on it. The transfer still went through. What failed was the layer that checks, before paying, that an instruction really came from that executive.
What happened
- Party
- ZUU, which runs financial media and finance businesses such as fundraising support. Listed on the TSE Growth market.
- What happened
- On March 19, someone posing as an executive issued a fraudulent transfer instruction in the business chat ZUU used. It was processed under the company’s existing rules and processes, and ¥96 million was paid from the company’s account to an outside account the same day (March 27 disclosure).
- How it came to light
- Soon after the transfer, doubts arose internally about the instruction’s authenticity. After checking the facts, the company judged third-party fraud highly likely. It asked its bank for a recall and filed a police report, but called recovery extremely difficult.
- Loss
- ¥96 million, booked as a “remittance fraud loss” in extraordinary losses for FY3/2026 (May 15 disclosure).
- Investigation
- A special investigation by a law firm (April 3 to May 12) found no intentional wrongdoing by officers or staff; an outside third party was responsible.
- Not disclosed
- Which chat service was used. Whether an executive’s account was taken over or a fake account was created (the investigation cites insufficient vigilance against fake accounts and similar attacks). Who approved the payment. Whether the payee was new.
Glossary
Business chat — A chat service used for internal communication. ZUU has not said which service it used.
Recall request (kumimodoshi) — Asking the receiving bank to return a transfer. Once the recipient withdraws the money, it is rarely returned.
CEO fraud — Fraud in which someone poses as a company's executive to get staff to send money. Japan's National Police Agency reports cases from around January 2026.
As far as disclosed, the attack ran as follows.
The stopping point is ②. Had the company checked, before paying, that the instruction really came from that executive, the transfer in ③ would not happen. The company says ② followed its existing rules.
March 19. Fake account or takeover: not disclosed.
The company says authenticity checks between the chat and the payment process were insufficient.
Same day.
Soon after the transfer. Recovery described as extremely difficult.
Timeline — disclosure and response
- A transfer instruction from a fake executive arrives in the business chat; ¥96 million is paid the same day. Doubts arise soon after.
- ZUU discloses the incident.
- A law firm begins a special investigation (through May 12).
- ZUU discloses the investigation’s findings, its prevention measures, and the ¥96 million extraordinary loss.
The facts rely on ZUU’s disclosures of March 27 and May 15 (both primary). The investigation report itself has not been published. ZUU says it had already begun reviewing its cash-management and payment-approval process, and the incident happened partway through that review.
After disclosure
- ZUU (done): Moved all internal communication to Slack with mandatory SSO and two-factor authentication. Required multiple approvers for transfers and began, provisionally, confirming first-time payees in advance. Broke up a concentration of bank-account administrator rights and removed unneeded accounts.
- ZUU (planned): Make confirmation by phone, in person or online mandatory for large transfers. Revise accounting rules and add staff, including at the accounting-lead level. Set security standards covering group companies and contractors. Executives are returning part of their pay, and the CEO will directly oversee accounting and finance for now.
- Causes cited by the investigation: Weak internal controls over payment approval and withdrawals (poor understanding and inconsistent application of the rules, and a cashier lacking accounting experience), understaffed accounting, insufficient attention to internal-audit findings, and insufficient vigilance against fake accounts and insufficient measures for the business chat.
- Industry: Japan’s National Police Agency reports CEO fraud since around January 2026, in which emails posing as executives get staff to set up social-media groups, disclose account balances and then send money: 127 cases and about ¥3.88 billion in losses in January–June.
Why it wasn’t stopped
The failure was not a lack of internal rules. There were rules, but nothing in front of the payment checked that the instruction really came from that executive.
The company disclosed that the payment followed its existing rules and processes. The later investigation cited poor application of those rules. No step checking, before paying, that the instruction really came from that executive is visible.
Proof here means checking, before paying and by a means other than the one the instruction came in on, that it really came from that executive, and keeping a record. Detection means noticing something is wrong after paying.
outside account
The instruction was doubted soon after the transfer, and the company moved quickly to a recall and a police report, but the money was already in the outside account. Instructions arrive by chat; payments run through the company’s process. Between the two, checking the instruction’s origin did not work well enough (company disclosure). That distance is the gap between detection and proof, and it is structural.
The same structure appears in the Hong Kong deepfake meeting fraud (a pre-recorded video call faked the CFO and ordered transfers).
How to counter this
Pay on an instruction only once you have confirmed it came from the person who gave it, however it arrived: by chat, email or phone. Then faking an executive’s name or account is not enough to move money. It sits in front of detection, not in place of it.
Industries and operations to watch
- IndustryFinance
- Companies with heavy money flows, where accounting staff pay out on executives’ instructions.
- OperationApproval
- Transfers made on an executive’s or manager’s instruction, and their approval.
- OperationBank account changes
- Payments to first-time payees, or to new payees in a hurry.
Do today’s controls close it?
| Control | This case | Why |
|---|---|---|
| Internal payment rules | Partial | Rules existed but were not consistently applied (special investigation). Whether they covered checking an instruction’s origin is not disclosed. |
| Multiple approvers | Partial | More approvers looking at the same instruction can still pass a faked one. |
| Two-factor authentication, SSO | Partial | Protects real accounts from takeover. Instructions from fake accounts still have to be told apart. |
| Recall and police report | Ineffective | After-the-fact remedies that do not stop the transfer. Recovery is described as extremely difficult. |
- Confirm with the person who gave the instruction, by a different means. Do not verify a chat instruction inside the same chat.
- Do not pay on instructions you cannot confirm. Never skip the check, least of all when an instruction urges speed or secrecy.
- Record whose instruction was paid, and how it was confirmed. Keep the result as proof, separate from the chat history, so the instruction’s origin can be shown to a third party later.
Three things to confirm about payment instructions
- Is there a step to confirm, outside the chat, a payment instruction received in internal chat?
- Do you hold payments to first-time payees until the check is done?
- Can the same person both create and approve a transfer?
Note: if the instructing person’s device or channels are also compromised, this check can be passed. And it protects where an instruction came from; the real person giving a wrong instruction still needs separate controls.
Sources
- Primary, disclosureZUU “Notice of the occurrence of a fund outflow incident” (in Japanese)
- Primary, disclosureZUU “Notice of the results of the special investigation into the fund outflow incident and prevention measures” (in Japanese)
- Primary, disclosureZUU “Notice of extraordinary loss for FY3/2026 and differences between forecast and results” (in Japanese)
- Primary, statisticsNational Police Agency of Japan “Threats in cyberspace in the first half of 2026”, column on CEO fraud (in Japanese)
1 more (reporting, analysis)
- PressScanNetSecurity Report on ZUU’s disclosure (in Japanese)
References: “The last layer left in AI-era cyber defense”