“A Man’s Instincts Save Him from a Devastating Scam: A Cautionary Tale of Quick Thinking and Online Security”

In a recent incident, Mr. V, a resident of Hoang Liet, Hoang Mai, Hanoi, received a phone call from someone claiming to be a staff member of the Hoang Mai Tax Department. The caller asked Mr. V to verify his newly established company’s information on the Public Service Portal via Zalo. As the information provided by the caller matched his company’s details, Mr. V complied with the instructions.

Mr. V downloaded the application provided by the caller to synchronize information and logged into his bank account. He was then asked to perform facial recognition verification twice. During the second verification, he became suspicious as he had encountered a similar scam on the Hanoi Police’s electronic information portal and in media reports. He immediately called his bank’s hotline and requested to lock his account, preventing further losses. However, within two minutes before the account was locked, the scammers had already made two transactions, stealing nearly VND 1 billion from Mr. V’s account.

According to the Hanoi Police, the scammers usually impersonate tax officials and contact victims via phone calls, Zalo, or Facebook, inviting them to the tax office for information verification. They then convince victims to download a fake application of the General Department of Taxation from fraudulent websites, disguised as Google Play Store (CHPlay).

Once the victim clicks on the link, the scammers guide them to install the fake application in “.apk” format and grant it extensive permissions to operate. These fraudulent applications typically request excessive permissions, including access to data, screen capture, and even assistive device control.

If the user agrees, the scammers can monitor and control the victim’s phone remotely. Their primary target is the victim’s banking and securities account login information. Once they have this information, they employ various tactics to obtain the OTP code and transfer money from the victim’s account.

As per the State Bank’s regulations on implementing safety and security measures for online and card-based payments, effective July 1, 2024, all money transfers of VND 10 million and above must be authenticated using biometrics. Customers performing transactions above the specified threshold or using a mobile application for the first time on a new device will be required to provide facial recognition verification. Scammers exploit this requirement by asking victims to verify their faces multiple times to facilitate large transactions from their accounts.

To avoid falling victim to such scams, the Hanoi Police’s Cyber Security and High-Tech Crime Prevention Division advises the public not to download unfamiliar applications or follow instructions from unknown sources. Always verify the authenticity of such requests by directly contacting the tax department or the local police through official channels. Moreover, only download applications from trusted sources like CHPlay and App Store, and never grant full device control permissions to any application.

Additionally, users of open operating systems like Android should be cautious when granting permissions to unfamiliar applications installed from third-party sources. On the other hand, iPhone users are relatively safer due to the restricted nature of the App Store, which makes it harder for malicious software to infiltrate.