$11.9 billion lost in Vietcombank account: Strange app from Japan, plaintiff appeals

Plaintiff Appeals

According to the verdict issued by Tu Son City People’s Court on March 20, the panel of judges ruled, partially accepting the lawsuit filed by Ms. Tran Thi Chuc (born in 1974, residing in Tu Son City, Bac Ninh Province), ordering Vietcombank to compensate her for damages in the amount of 700 million VND out of a total of 11.9 billion VND that was illegally withdrawn from her account.

“The amount of 700 million VND that I received according to the verdict is very small compared to the total amount of 11.9 billion VND that was illegally withdrawn due to many faults caused by Vietcombank,” quoted from Ms. Chuc’s Appeal.

Speaking to us, Vietcombank’s communications representative said that the bank had filed an appeal against the Tu Son City People’s Court’s judgment of first instance because there was no basis to force the bank to compensate in this case.

“We have filed an appeal immediately after receiving the judgment of first instance from Tu Son City People’s Court. The Procuracy has also protested against this judgment,” said Vietcombank’s representative.

The court ordered Vietcombank to compensate 700 million VND for the loss of 11.9 billion VND. Photo: Ngoc Tuan

Why didn’t the bank send an SMS banking message?

On the afternoon of April 22, 2022, Ms. Chuc went to Vietcombank Kinh Bac Branch to open a transaction account. After opening the account, she called and texted the account number to her relatives and asked them to transfer 12 billion VND so that she could “prove her financial cleanliness, not related to money laundering by drug criminals, according to the request and instructions via mobile phone of a person who claimed to be an “investigator of Da Nang City Police”. As of April 23, 2022, Ms. Chuc’s account balance was 11.9 billion VND.

On the morning of April 25, 2022, Ms. Chuc went to Vietcombank Kinh Bac Branch to request a check of her account balance and was informed that the balance was only 114,718 VND, while she confirmed that she had not made any withdrawal or transfer transactions.

Therefore, Ms. Chuc sued, demanding that Vietcombank be held liable to compensate for the entire amount of 11.9 billion VND.

Meanwhile, Vietcombank disagreed with the customer’s lawsuit on the grounds that the bank had fully complied with the SBV’s regulations on opening and using payment accounts and carried out all regulations on business and expertise when advising on procedures and establishing the opening of the account.

In this case, the question arises as to why the customer did not receive an SMS notification when the money in her account was withdrawn.

Vietcombank stated that during the account opening process, the customer did not register for the service of receiving notifications of balance changes via SMS messages.

Ms. Chuc’s mobile phone number was registered for the electronic banking service to enter the password to activate the electronic banking service and the authentication methods of the transaction (SMS OTP or smart OTP).

“Specifically, with the service of receiving balance changes via account, bank staff introduced the customer to the following forms of receipt: Through the VCB Digibank application or via SMS banking. The account opening staff clearly advised on the features as well as the form and fee for SMS banking services (11,000 VND/month), Ms. Chuc chose not to register for SMS banking but chose to receive balance changes via the VCBDigibank application”, Vietcombank expressed its viewpoint in court.

Transactions to transfer money from Ms. Chuc’s account to other accounts were mainly carried out at night, the transaction authentication method was smart OTP. The system records the transactions as valid requests from the account owner with full information about the user, password, valid OTP code, and processes the transaction validly and legally in accordance with the regulations.

Dangerous when phone is attacked by malware

It is worth noting that on May 13, 2022, the Investigation Police Agency of Bac Ninh Province sent an Official Letter to Vietcombank Bac Ninh Branch to verify Ms. Chuc’s denunciation.

Ms. Chuc denounced the subjects To Ngoc Dau (unclear year of birth, address), number 12191, working at the Da Nang City Road Traffic Management Department, and subject Hai (unclear year of birth, address), working at the Department of Investigation Police on Drug Crimes for fraud and appropriation of 26.560 billion VND. The subjects informed Ms. Chuc that she was involved in a traffic accident in Da Nang City and was related to a drug trafficking and money laundering ring.

Subject Hai asked Ms. Chuc to set up two bank accounts and install software called “security software” on her phone. Then the subject Hai asked Ms. Chuc to transfer 26.65 billion VND to two bank accounts to prove that Ms. Chuc’s source of money was clean and not related to the drug trafficking and money laundering ring.

When transferring money to the above two accounts, Ms. Chuc had all 26.56 billion VND of Ms. Chuc transferred to other bank accounts by unknown subjects without Ms. Chuc’s consent.

In the conclusion of the appraisal No. 5425 dated November 30, 2022 of the Institute of Criminal Science (Ministry of Public Security) concluded that Ms. Tran Thi Chuc’s Samsung Galaxy A13 phone had installed a “strange” security software. This application connects to a server located in Japan.

This application allows reading and sending SMS messages, receiving and processing SMS messages, reading call history, creating new call history, making calls, call forwarding, reading contacts, editing contacts, accessing location data from the device.

At the court hearing, Ms. Chuc’s lawyer argued that, through camera data recorded at the time Ms. Chuc opened an account, there was nowhere to show that bank staff showed her where the document was listed for her to read first. The location for posting the notice is not convenient for customers to access. Thus, the posting is merely adversarial, and Vietcombank Kinh Bac Branch staff did not fully comply with the account opening procedure.

The lawyer also argued that the bank’s system failed to control irregularities in the transaction, failed to report the incident to the SBV and Vietcombank’s Head Office for instructions on how to handle the incident; did not apply the necessary professional measures and did not propose to the competent authorities measures to prevent criminals from disposing of Ms. Chuc’s money;…