‘Biometric authentication in many banks is still bypassed’

The information was shared by Lieutenant Colonel Trieu Manh Tung, Deputy Director of Cyber ​​Security Department (A05), Ministry of Public Security, at the Smart Banking 2026 event on the morning of October 22 in Hanoi. Besides the risks from the development of AI tools used in fraud, Mr. Tung also raised some new risks, such as cyber criminals bypassing biometrics; Direct attack on the banking system.

According to Mr. Tung, Vietnam has many technical regulations in the banking industry, jailbroken devices are not allowed to make payment transactions, and limit the first transaction on new devices. Money transfers above a certain limit are also required to require biometric authentication to ensure that it is the owner performing the transaction. However, he also pointed out the fact that in some recent attacks to appropriate hundreds of billions of dong, money was still transferred very quickly.

“So biometrics in many banks are still bypassed in many cases. This is reality,” he said, saying attack groups inserted still photos or short videos to trick facial recognition systems. In addition, criminal rings also hire people and lock people up to operate transactions. This leads to online fraud or system intrusion attacks, and misappropriated cash flows are dispersed at a very rapid speed.

Criminals turn to directly attack the banking system is one of the new risks in the cybersecurity situation in Vietnam recently. According to Deputy Director A05, in the past, money appropriation often came from crooks attacking users, but recently, there have been cases of money loss from banks and financial units.

He also assessed that this activity “cannot rule out the possibility of becoming an industry”, when groups are well organized, considering this a profession to gain illegal profits. Some of the arrested groups have shown that they are tightly organized lines, with servers and operators abroad, with dozens of people participating in many stages of money flow.

“When criminals consider this as a profession, developments will be as complicated as online fraud,” he emphasized. Meanwhile, the response ability of units is a problem. Deputy Director of A05 said that the units “when communicating, everything is very good, but when an incident occurs, it is extremely embarrassing”. He cited many cases where, despite the support and coordination of all parties, tracking accounts still took 1-2 days, leading to difficulties in prevention and handling.

Previously, in his opening speech at the event, Deputy Governor of the State Bank of Vietnam Pham Tien Dung also assessed that cybercrime attacks on financial and banking systems have changed many times in recent times.

“Current attack methods do not necessarily target customer accounts, but hackers can seek to appropriate money from both customers and banks,” he said, requiring banks to simultaneously monitor both network security and transaction activities.

Mr. Dung said that the banking system is processing about 100 million payment transactions per day, with a total value of about 1.2 million billion VND. At some banks, over 95% of transactions have been carried out via digital channels. With that reality, he emphasized that trust is the most important asset that the banking system must continue to preserve and strengthen.

Faced with new threats, Lieutenant Colonel Trieu Manh Tung requested the State Bank and the Ministry of Public Security to strengthen coordination to ensure the security of the banking system, and at the same time deploy solutions to trace and prevent fraudulent money flows, to ensure that the development of digital channels is always associated with security and safety.

He also emphasized the need to invest in network security, clean customer data and perfect the legal corridor. According to him, current regulations require funding for cybersecurity to be at least 15% when investing in building information systems. Therefore, information technology and digital transformation projects in the banking industry need to comply with this regulation.

The Ministry of Public Security is coordinating with the State Bank to deploy a system to trace and prevent fraudulent money flows from appropriating assets. When completed, the system can support blockade and prevent cash flow when problems arise, thereby minimizing damage to organizations and users.

Besides responding to threats from AI, one of the issues discussed at the event was the application of AI in banking operations.

As a representative of a unit specializing in providing sovereign AI infrastructure for key fields such as finance and banking, Mr. Vu Thanh Tung, General Director of GreenNode, said that when applying AI, Vietnamese banks are facing three problems at the infrastructure layer: large investment costs, with an 8-GPU server costing about 20 billion VND; device access time is long while AI technology changes continuously; and a team capable of operating large-scale AI infrastructure systems in Vietnam is still very lacking.

“Banks need to master two things: the speed of innovation in human skills and data and professional knowledge, because each bank is a different entity. As for the infrastructure, to take advantage of the resources of the entire ecosystem, the bank can assign it to specialized partners,” Mr. Tung said.

Deputy Governor Pham Tien Dung also emphasized that AI needs to be placed in the overall development strategy of the bank, associated with data, business processes, human resources and governance models, and comply with AI safety regulations issued by the State Bank. “AI applications must be responsible to customers, to the organization and bring real efficiency. AI cannot only be considered as a technological shell to create a modern image,” he said.