Nearly 1.9 Million Vietnamese Accounts Use Weak Passwords as Banks Expand Fraud Defences

Simple passwords meet a faster financial threat

Nearly 1.9 million accounts belonging to Vietnamese users still rely on easy passwords such as "123456", according to figures presented at the Vietnam Digital Financial Security Forum in Ho Chi Minh City on November 6, 2026. The warning comes as banks expand systems intended to spot suspicious transfers and help recover stolen money.

Colonel Nguyen Ba Son, deputy director of the Ministry of Public Security's Department of Cybersecurity and High-Tech Crime Prevention, known as A05, said authorities recorded nearly 1,000 online fraud cases involving stolen assets in the first six months of 2026. Losses ran into trillions of Vietnamese dong.

Financial institutions face pressure on several fronts: criminals are using artificial intelligence to prepare attacks faster, customers remain vulnerable to impersonation, and some organisations still lack basic security controls. Meanwhile, digital payments have become an everyday service for much of the population.

Figures presented by Hoang Minh Tien, deputy director of the State Bank of Vietnam's Information Technology Department, show the scale. Vietnam processed more than 21 billion cashless transactions during the first eight months of 2026, worth more than VND260 quadrillion. Digital channels account for more than 95% of transactions at many credit institutions.

The forum brought together the National Cybersecurity Association, Vietnam Investment Media Group, the State Bank and the Vietnam Banks Association. Its discussions connected a familiar weakness, passwords that are easy to guess, with a broader challenge: protecting customers before, during and after a fraudulent payment.

Fewer attacks, more organisations reporting harm

The National Cybersecurity Association's 2025 research and survey report estimated that Vietnam faced about 552,000 cyberattacks that year, down 19.38% from 2024. Its Technology Department conducted the survey in December 2025, drawing on responses from more than 5,300 organisations.

The government's survey summary records a rise in the proportion of agencies and businesses reporting harm: 52.30% in 2025, compared with 46.15% in 2024. That is an increase of 6.15 percentage points, even as the estimated number of attacks fell.

The association described attackers as becoming more selective, preparing carefully and exploiting targets more deeply. For an organisation, the practical danger is therefore about the damage an intrusion causes as much as the number of attempts it faces.

At the forum, figures attributed to the National Cybersecurity Association and Viettel Cyber Security put finance and banking at about 41% of attacks. Son also identified the sector as a priority target for international hacking groups and cybercriminals.

Why stolen data can cause lasting damage

The association identified five common forms of attack in 2025: denial of service, insertion of gambling advertising links, targeted cyberespionage, data theft and ransomware. A denial of service attack overwhelms a service with traffic; ransomware locks information through encryption and demands payment to restore access.

Attackers can combine these methods. The association described disruptive attacks that draw security teams' attention while intruders quietly enter other parts of a network, install malicious software and remain there.

Vu Ngoc Son, head of the association's Technology Department, described a sequence in which criminals first steal valuable information for sale, exchange or further exploitation. They then encrypt the victim's data to demand a ransom after exhausting opportunities to take more.

Customer information can therefore remain exposed after a bank or business restores its systems. Backups help an organisation recover files, while preventing theft requires controls over who can reach the information and systems that detect unusual access.

The association's assessment of 2025 placed data intrusion and theft among the incidents causing the greatest harm. Its forecast for 2026 identified data security and attacks automated with AI as central concerns, a warning echoed in the forum's discussion of banking risks.

AI is speeding up both banking and crime

Son said criminals were using AI to shorten the time needed to search for weaknesses and prepare attacks. Work on large financial information systems that previously could take months can now be completed much faster, he said, without giving a specific new timeframe.

Dr Dao Minh Tu, vice chairman and secretary general of the Vietnam Banks Association and a former permanent deputy governor of the State Bank, described a banking industry moving beyond applications that customers operate themselves. Banks are developing services that communicate with customers and assist them automatically.

Tu said around 80% of Vietnamese businesses had adopted AI, while more than 70% of credit institutions used it for tasks including credit scoring, electronic identification, fraud detection and checks against money laundering. Credit scoring helps lenders assess a borrower's ability to repay; electronic identification checks a customer's identity remotely.

Dam The Thai, deputy general director of HDBank, said the bank was testing AI that detects fraud as transactions happen, alongside automated credit assessment and approval taking two to three minutes.

Readiness remains uneven. Figures from Cisco's AI Readiness Index cited at the forum classified only 13% of Vietnamese businesses as fully prepared for AI. Some 63% placed improving the ability of their technology infrastructure to expand and adapt at the top of their priorities. Introducing an AI tool and having the data, equipment and controls to use it safely are different stages of adoption.

Weak passwords and convincing impersonation

Nearly 1.9 million accounts using simple passwords illustrate a weakness at the customer level. A predictable sequence such as "123456" gives criminals an easier starting point when trying to gain access.

Survey findings presented at the forum also showed that only 36% of respondents expressed concern about deepfakes, the lowest proportion among the risks covered. Deepfakes are images, video or voices created or altered with AI to make someone appear to say or do something they did not.

Tu warned that criminals can combine fake identities with carefully prepared fraud scenarios to persuade people to transfer money themselves. Such a scam can reach a customer through an apparently familiar face or voice, rather than through an obvious attempt to break into a banking application.

Thai argued that customer knowledge and confidence are essential alongside bank technology. He called for banks, telecommunications companies, electronic wallets, digital platforms and regulators to help build shared trust in digital services.

The total number of accounts examined, and the method used to identify weak passwords, were not specified in the forum figures. The nearly 1.9 million figure therefore comes without a percentage showing its share of Vietnamese accounts.

A restaurant card theft exposed another gap

Son described a case uncovered in 2025 involving a suspect who posed as an employee at upscale restaurants. When customers handed over bank cards for payment, the suspect secretly removed the cards' chips.

The suspect attached those chips to other card blanks and used the resulting cards to buy several recent iPhone models, stealing more than VND200 million, or about US$7,700.

Police subsequently coordinated with the State Bank to notify commercial banks and request reviews and adjustments to services involving physical cards fitted with chips.

The case places the security challenge beyond passwords and banking applications. A customer's card also passes through people and payment procedures in shops and restaurants. Criminals can exploit that handling process while banks concentrate on protecting their digital networks.

Warnings are already stopping suspicious payments

The State Bank's monitoring system is connected to nearly 100 financial institutions and has identified more than 668,000 accounts showing signs of violations, according to figures presented by Tien. Banks have issued millions of warnings and coordinated the recovery or temporary suspension of funds worth trillions of dong.

SIMO, the information system supporting payment risk management, monitoring and fraud prevention, sent 5.8 million customer alerts from 2025 through October 2026. Nearly 1.9 million instances of customers stopping or cancelling suspicious transactions followed, involving almost VND7.2 trillion.

Those figures amount to roughly one stopped or cancelled transaction for every three alerts. The totals count alert and customer response instances, so a customer who received several warnings may appear more than once.

SIMO's nearly 1.9 million stopped or cancelled transaction instances concern payment warnings. The similarly sized weak password figure concerns account security. Together, they show two places where protection matters: access to an account and the decision to send money.

For customers, a warning creates a chance to pause before money leaves. For banks and police, connected information can help identify where suspicious funds are moving and support a faster response.

Tracing stolen money across banks

The Ministry of Public Security and the State Bank are working on arrangements to follow money associated with fraud across bank accounts. Son said the two bodies held a working session three days before the November 6 forum to discuss a pilot system for tracing and reconciling those flows.

Details presented about the banking programme place the start of a tracing and urgent interception pilot at major commercial banks in June 2026, with expansion across the system planned for the first quarter of 2027. Son's account focused on the further discussions held in early November.

Speed matters because criminals can move stolen funds through several accounts and intermediaries within minutes. A response confined to the first receiving bank can quickly lose track of the money as it moves elsewhere.

The main dates and periods are:

• December 2025: The National Cybersecurity Association surveyed more than 5,300 organisations for its annual assessment.
• January to June 2026: Authorities recorded nearly 1,000 online fraud cases involving stolen assets.
• June 2026: The banking programme's stated starting point for piloting urgent tracing and interception of transfers between banks.
• November 3, 2026: Police and the State Bank discussed the proposed tracing and reconciliation system, according to Son's account of a meeting three days before the forum.
• First quarter of 2027: Planned expansion of the tracing solution across the banking system.

Tu called for a unified financial data platform so institutions can share information under security and privacy rules. Thai also proposed sharing fraud warnings as events happen across banks, telecommunications providers, electronic wallets and licensed digital asset exchanges.

Security investment still leaves basic gaps

Commercial banks devote about 17.2% of their digital transformation investment to information safety and cybersecurity, Tien said. He also called for risk assessments, security testing, incident exercises and oversight of technology suppliers.

The association's broader survey of agencies and businesses showed progress in preparation. Some 75.93% provided cybersecurity awareness training, 51.45% held security exercises, 51.65% had deployed or were operating security operations centres, and 76.35% had backup systems. A security operations centre brings monitoring and incident response together.

Basic weaknesses persisted across the surveyed organisations. Some 47.72% lacked cybersecurity staff, 27.80% had no internal cybersecurity standards, and 51.87% lacked centrally managed software against malicious programs.

Another 8.71% used no antivirus software, while 9.38% had no controls such as firewalls governing internet access. These figures describe the wider organisational survey, covering agencies and businesses rather than commercial banks alone.

The practical gap is between preparing people and maintaining protection across an entire organisation. Training can help staff recognise danger, while effective defence also requires people to monitor systems, consistent software deployment and rehearsed procedures for responding when an attack succeeds.

Data rules and preparations for quantum computing

Tu proposed stricter protection of banking information, personal information and biometric data under Vietnam's Law on Data and Law on Personal Data Protection. Biometric data includes physical identifiers such as a face or fingerprint used to confirm identity.

He called for important data to be stored and processed at secure data centres in Vietnam. His proposals also included clear responsibility for controlling AI systems and human approval for large or highly sensitive transactions.

Poorly standardised data and weak control of AI models can affect both automated decisions and customer privacy, Tu warned. A banking system that makes decisions quickly still needs reliable information and a clear process for reviewing sensitive actions.

Quantum computing presents a longer term concern. Tu warned that its computing power could threaten some conventional encryption protecting payments, digital signatures and banking data. Digital signatures help establish who authorised an electronic instruction and whether it has been changed.

Tu urged banks to assess their dependence on current encryption methods and plan a transition to post-quantum cryptography, methods designed to withstand attacks using quantum computers. His wider message connected these technical preparations with public confidence: as about 89% of Vietnamese adults have payment accounts, safeguarding digital banking has become part of protecting an everyday financial service.

Key Points

• Nearly 1.9 million Vietnamese accounts still use simple passwords, according to figures presented at the November 6, 2026 financial security forum.
• Vietnam faced an estimated 552,000 cyberattacks in 2025. Attacks declined by 19.38%, while the share of surveyed organisations reporting harm rose to 52.30%.
• Authorities recorded nearly 1,000 online fraud cases in the first half of 2026, with losses running into trillions of dong.
• SIMO issued 5.8 million alerts through October 2026, followed by nearly 1.9 million instances of customers stopping or cancelling suspicious transactions worth almost VND7.2 trillion.
• A pilot for tracing and urgently intercepting suspected fraud proceeds is intended to expand across the banking system in the first quarter of 2027.
• Forum proposals included stronger data protection, shared fraud warnings, human control over sensitive AI decisions and preparations for quantum computing risks.