The Police Warn of a Biometric Setup Support Scam

Scammers have been taking advantage of the recent mandate from the State Bank of Vietnam, which requires biometric authentication for certain online transactions, to deceive unsuspecting individuals. Specifically, these fraudsters have been contacting potential victims through phone calls, text messages, or social media platforms (such as Zalo and Facebook) to offer guidance on collecting biometric data. They then request personal information, bank account details, identity card images, and even facial images under the pretext of providing assistance.

In some cases, they may ask for a video call to capture the victim’s voice and gestures. Furthermore, they trick people into accessing suspicious links and installing applications on their phones to allegedly facilitate the collection of biometric data. Once they have obtained this sensitive information, they proceed to steal money from the victims’ bank accounts and misuse their personal details.

The Ho Chi Minh City Police have issued a warning, urging residents to never disclose their OTPs, bank passwords, or any other sensitive information to anyone, including bank staff. Banks do not directly contact customers to guide them through biometric data collection processes. Therefore, individuals must remain vigilant and refrain from accessing unfamiliar links sent via Facebook, Zalo, SMS, or email to prevent falling victim to fraud and identity theft.

According to Decision No. 2345/QD-NHNN by the State Bank of Vietnam, various types of online transactions for individual customers will require biometric authentication using facial recognition (Facepay) from July 1, 2024. Specifically, this applies to the following transactions: initial activation of digital banking services or device changes; money transfers exceeding VND 10 million; transactions valued at VND 10 million or less but with a daily cumulative total exceeding VND 20 million; payments exceeding VND 100 million; and foreign currency transactions or currency exchange requests, regardless of the transaction value.

To enable facial recognition for transactions, customers must first register their biometric data with their bank. Banks have provided instructions for customers to register their biometric data on their smartphones in three simple steps: taking photos of the front and back of their chip-enabled identity cards; scanning the Near-Field Communication (NFC) chip on the cards; and scanning their faces while entering an OTP.

While most customers have reported a smooth and quick process, some technology forums and groups have seen complaints about difficulties in registering biometric data on banking applications, particularly during the NFC scanning step for identity cards.

Banks Warn of Scams Offering Fake Biometric Setup Assistance

Fraudsters are taking advantage of the challenges faced by customers in setting up biometric authentication. They are impersonating bank employees and offering assistance with the biometric setup process to steal customers’ information and ultimately, their funds.

Several banks have issued warnings to their customers about these scams. Agribank, for instance, has alerted customers that fraudsters are posing as bank staff and contacting individuals who are facing issues with biometric authentication. After obtaining their personal information, these scammers steal money from their bank accounts and misuse their details.

Agribank emphasizes that customers should never disclose their OTPs, bank passwords, or any sensitive information to anyone, including purported bank employees. The bank also clarifies that they do not directly contact customers to guide them through biometric data collection.

Vietcombank has issued a similar warning, cautioning customers against accessing unfamiliar links or installing applications on their phones for alleged biometric data collection. The bank asserts that they do not request customers to provide personal information through calls, SMS, email, or chat software like Zalo, Viber, or Facebook Messenger. Customers are advised not to click on links, disclose security information related to their bank or card accounts, or share any personal details that could compromise their financial security.

Sacombank has also advised customers to refrain from updating their biometric data through any websites or applications other than the official ones. The bank assures customers that they will never ask for OTPs, passwords, card numbers, or security codes through phone calls or links.

Speaking at a recent seminar on the modus operandi of cybercriminals, Captain Cao Viet Hung, Deputy Head of Room 4 – A05, Ministry of Public Security, highlighted the increasing complexity of cybercrimes, both domestically and internationally. He noted that attacks on information technology systems and online scams in the financial and banking sectors pose significant risks to financial security and have resulted in substantial losses for individuals.

While commending the State Bank’s Decision 2345/QD-NHNN, Captain Hung also cautioned that criminals have already begun adapting their tactics to circumvent the new regulations.

A05 recommends that individuals take proactive measures to protect themselves: stay vigilant, verify information before conducting transactions, avoid online loans from unknown sources, never transfer money or share personal data with strangers, and enable two-factor authentication. Additionally, individuals should refrain from renting or lending their bank accounts, cards, or personal documents to others, and minimize the disclosure of personal information online.