There’s a company out in Japan that I’ve been sitting on for a while. It has the shape of a thing I like: a sort of dull, cash-generative business with a defensible position, trading at a great price, divided into two segments where one is growing much faster than the other behind the curtain. The company has grown every single year since its founding, and it’s run by a founder who owns a lot of the stock and originally built it to solve a personal problem.
Better yet, it’s tiny, with revenues of <$20mn. And it operates in a niche so specific and local that even investors who follow the Japanese market walk right past it.
The company’s name appears nowhere in the experience of its end users. And yet, it has ended up embedded in the daily lives of tens of millions of Japanese people through a distribution channel it didn’t build and doesn’t pay for. And it addresses a social problem the government has decided it needs to fix.
But the most interesting bit is the financials. Its cash generation runs at roughly double reported earnings, with the balance sheet loaded with cash at a third of the market cap. That mismatch between valuation multiples (earnings vs cash) might be the best explanation of what leads to this opportunity.
Let’s dig in…
Atsushi Akita built the first version of this product in 2010 because his grandfather kept getting phone calls from scammers, and I bring that up not because founder origin stories are load-bearing in an investment case but because this one explains the otherwise odd shape of the company. The company is Tobila Systems, ticker 4441 on the Tokyo Exchange, with a market cap of JPY12.8bn, or ~$80mn. It does one thing extremely well through a couple different offerings.
Japan has a fraud problem. Specifically, it has tokushu sagi, or “special fraud,” the catch-all term the National Police Agency uses for telephone-based schemes where the criminal and the victim never meet. The archetype of such schemes is the ore ore sagi, meaning the “it’s me, it’s me scam,” where someone calls an elderly person, says some version of “Grandma, it’s me, I’m in trouble, I need money,” and the grandma, who has several grandsons and cannot perfectly distinguish their voices over the phone, wires the money. Over time this evolved into a small industry with fake police officers, fake bank officials, fake debt collectors, multi-person scripts, and the works.
Here’s the part that matters for Tobila: the attacks are mostly mobile. In Q12025, mobile phones were the point of first contact in 67% of police-impersonation scams, and the victim pool, which used to be almost entirely elderly, now includes a meaningful share of youngsters in their 20s and 30s. The fraud followed the phones, and in Japan a large share of the phones run, somewhere in the stack, on Tobila’s database.
Here’s what the database does, and why it’s hard to replicate. It knows which phone numbers, URLs, and message patterns are associated with fraud, and it blocks or flags them. The interesting part is the inputs. There are three. The National Police Agency feeds Tobila numbers and URLs used in active crimes, which is the kind of data you can’t buy or scrape. Tobila’s own survey team hunts for new patterns daily. And fifteen million users generate feedback. When a suspicious call hits a phone, the response data feeds back into the database, a pool that’s been building for fifteen years. In FY25, the system rendered judgments on >5bn calls, emails, and messages.
Tobila’s carrier channel acts as a moat. In Japan, you buy your phone and service from a carrier, with the three largest being NTT Docomo, KDDI (au), and SoftBank, and those carriers sell optional add-ons. NTT’s “Anshin Security,” which includes spam-SMS blocking, runs at JPY220/month ($1.40). KDDI’s “Meiwaku Message / Denwa Block” comes inside au Smart Pass Premium at JPY499/month. The carrier makes the upsell and collects the money, and Tobila receives a license fee. Tobila’s got 15mn users under that umbrella, and its CAC for incremental users is close to zero. A competitor — and there are competitors, like Whoscall (Gogolook, listed in Taiwan with >70mn global downloads) and Hiya (Samsung-backed with 450mn users worldwide) — has to convince each user to download an app, one at a time. Tobila’s investor presentation shows its MAU base at 4-5x the next-closest Japanese competitor, though it doesn’t name the rival. I’ll take that with some skepticism. But even so, to take Tobila’s position you wouldn’t need a better algorithm, but to win the carrier contract.
This structure, B2B2C, invisible to the end user, embedded in the carrier’s distribution, is what makes Tobila’s Security business (more on the other part of the business in a minute) something close to a toll booth. Carriers need the product because fraud protection is a selling point, but more importantly because the government has made clear that carriers have a regulatory obligation to strengthen anti-fraud measures. (The Ministry of Internal Affairs and Communications issued a formal directive in April 2025, which matters when you’re NTT.) Tobila needs the carriers for reasons already touched on. The result is a symbiotic arrangement in which neither side has an obvious reason to walk away. Add the fact that Tobila sits inside the Japan Cyber Crime Control Center (JC3) and holds data-sharing agreements with financial institutions such as JCB, and it becomes clear that the network holds institutional depth beyond purely user counts.
In FY25, the Security business comprised 76% of total revenue. It grew mid-single digits at a segment-level margin of ~70%. This thing used to grow double-digits every single year, but those growth days are likely behind it as carrier penetration has matured. Cash generation is excellent because little incremental capital is required to serve additional users. Incremental revenue from growing MAUs drops in buckets to segment contribution at 70%.
The remaining 24% of revenues, called Solution, is the B2B part of the business, and it splits into two: TobilaPhone Biz and TobilaPhone Cloud. TobilaPhone Biz is a blue hardware box, roughly the size of a thick hardback book, that installs between a company’s existing fiber-optic phone line and its existing office phones. You plug it in, and suddenly every call is recorded, transcribed, summarized by AI, routable through IVR, and searchable from a dashboard. It also blocks fraudulent and nuisance calls using the same database powering the Security business. TobilaPhone Cloud is the SaaS version, a fully cloud-based PBX running on smartphones and PCs, no hardware required, for JPY3.3k/month for a starter set (one number, two users, two simultaneous calls).
This is where it gets interesting. Because before we get to the peculiar financials, I wanna talk about how the Solution business has been performing.
In FY23, Solution revenue was JPY282mn. In FY24, it was JPY562mn, up 99%. In FY25, it was JPY900mn, up 60%. Management guided for FY25 growth in TobilaPhone Biz of 22%. The actual number came in at 50%. FY26 guides for Solution revenue of JPY1.4bn, up another 55%, with Biz alone guided for JPY950mn and Cloud at JPY450mn. Billing IDs for Cloud went from ~4.8k to more than 7.2k in the six months through April 2025 (the fiscal year ends in October). This segment is growing like weed, and its monthly churn sits below 1%.
Things might even accelerate. Like the Security business, Solution has two regulatory tailwinds that didn’t exist two years ago pulling it forward.
The first has a name: kasuhara, or customer harassment. Tokyo passed the country’s first customer-harassment prevention ordinance in October 2024, effective April 2025. A national amendment to the labor law mandating employer countermeasures is working through the Diet, and employers who fail to take adequate measures when an employee is subjected to harassment by a customer may be held liable for damages under existing duty-of-care obligations. A Teikoku Databank survey of >11k Japanese companies found that the top two phone-based countermeasures were “recorded notification announcements” and “automatic call recording,” first and second. That is what TobilaPhone Biz and Cloud do.
The second: Japan’s old analog phone network, which most business phones still route through, is being switched off, with NTT targeting full retirement by 2028. Every company in Japan still on legacy lines faces a forced migration decision in the next few years. TobilaPhone Biz participates in that migration on the hardware side, and TobilaPhone Cloud competes for the companies that wanna skip the hardware altogether. As of this year, TobilaPhone Biz is a built-in product in the new business-phone lineup sold by NTT East and NTT West, the two regionals that together hold ~60% of the fixed-line market. If that distribution catches, the installation charts start looking different pretty quickly.
So in Solution you have a business tripling in three years, that just integrated further into NTT’s distribution, that’s riding two separate regulatory tailwinds, and that beat its own growth forecast by more than 2x. This business is now a quarter of total revenues, and as it grows, the cash returns will look increasingly extraordinary.
In FY25, Tobila reported JPY630mn in net income, but operating cash flow ran 2.7x that at >JPY1.7bn, and the bridge is how TobilaPhone Biz gets paid.
When Tobila sells a unit through a sales agent, the customer pays for the hardware and the full 5-7-year license fee upfront, in one lump sum. The hardware gets booked immediately, and the license fee gets recognized ratably, a sliver each month, across the life of the contract. Most of what goes into contract liabilities is effectively free cash after the hardware is sold since the offerings are served from databases and servers that support the legacy security business. Inventory is minimal, and Tobila doesn’t own the hardware it sells, sitting on the agent’s balance sheet. This means the whole business requires no capital to grow, with invested capital being negative, which is another way of saying that growth is entirely free to shareholders.
The skeptic would object that cash is just pulled forward, and that if TobilaPhone Biz stopped growing, FCF crashes back toward earnings as the company services old contracts. That’s true. It’s also true of any business model where customers prepay, from insurance float to gift cards to SaaS annual contracts. The question is whether the float keeps compounding. FCF grew 26% in FY25 and is set to accelerate in FY26 as Solution takes an increasing share, while the gap between reported earnings and cash generation keeps widening. If you measure this stock on P/E, the stock is trading at 19x FY25 earnings but an astoundingly low <5x EV/FCF. A third of Tobila’s market cap is net cash. Putting the enterprise on 10x FCF implies roughly a double for the stock, and that probably even fails to appreciate how much further upside there is if growth in Solution keeps up. That Tobila didn’t disclose the Security and Solution segments separately until last year has helped keep this stock under-appreciated.
Now, the AI risk question, to which there are two sides.
The first is that AI will replace the need for Tobila altogether. If NTT or Apple or Google builds a sufficiently smart call-screening layer directly into the carrier network or the OS, why pay for a separate filtering database? AI call transcription, summarization, and the like, that TobilaPhone Biz and Cloud both offer, are increasingly commoditized. Apple and Google already screen calls natively. The long-run bear argument is that a standalone call-intelligence layer gets squeezed as the infrastructure around it gets smarter. The counter is that none of these tools have Tobila’s proprietary data or direct NPA feed, and that training a model that can reliably detect fraud requires that dataset that nobody else can buy or scrape.
But AI isn’t just a tool for defenders, but also an accelerant for the attackers. The ore ore sagi is getting dramatically harder to detect, because now it might actually sound like someone’s grandson. The criminals are using the same tech as the defenders, and they have the structural advantage that fraud only needs to work once, while prevention needs to work every single time with incredible accuracy. To me, that sounds more like a tailwind than a headwind for Tobila.
The capital return policy is a 35% payout ratio plus opportunistic buybacks (a 3.1% yield in FY25). The medium-term plan commits to at least JPY1.2bn in shareholder returns from FY25-28, which is a modest commitment relative to what the machine produces in FCF, and the cash balance will continue to accumulate unless M&A absorbs it. Tobila lists on the Standard Market where capital efficiency pressure from the TSE is less intense than on the Prime Market, so there’s no near-term external forcing function to accelerate the program. Like certain other stocks I’ve written about (like here, here, and here), this is probably the most legitimate knock against the business, and Tobila could be returning capital much more aggressively. Although it’s hard to complain. Founder Akita owns 47% of the shares and continues his mission.