Criminals raided JPY55 million ($506,201) from the bank accounts of consumers using 7Pay, the Japanese mobile payments service provided by multinational retailer 7-Eleven.

Thieves used a loophole in its security systems to impersonate account holders and make payments to fraudulently acquire goods. In a statement, the company said around 900 customers had been impacted by the attacks.

Chiefs at 7Pay promised to compensate users and suspended some functionality of the service, pending an investigation into its security systems. The company promised “a drastic solution” would be put in place.

Enterprise Times reported two people had been arrested in connection with the case. One of the suspects is accused of buying 146 cartons of cigarettes from one store using several different identities.

Although the company has promised to refund users, the incidents will do little to promote the security of mobile payments in the eyes of Japan’s consumers at a time when large companies in the country are actively trying to promote them.

Japan was one of the first countries to launch the technology, but it has failed to achieve mainstream usage.

Earlier this year, Worldpay VP for Japan global enterprise e-commerce Hideya Komori claimed Japan’s m-commerce industry was being held back by high-profile security breaches.