After the Oct 14 WASABI SWITCH intrusion, buyers received freemail messages that included accurate order datetime/product/amount/ship-to and urged LINE contact for a fake refund. Hunt ideas: (1) mail gateway — freemail senders whose bodies match order-confirmation field patterns plus 返金/refund/LINE keywords; (2) endpoint/web — new LINE friend requests or deep-links from mail clients in the hours after a purchase; (3) merchant side — correlate WASABI SWITCH / World Switch API anomaly logs around Oct 14 and ~04:00 JST Oct 16 with outbound data transfers; (4) expand the same lure pattern to other Japan EC platforms disclosing leaks this week.