The landscape of online scams and potential risks

The rapid growth of e-commerce has brought along increased risks and online fraud. Many people have received fake messages or calls impersonating police officers, tax authorities, or relatives to trick them into transferring money. In some cases, scammers even use deepfake technology to mimic voices and appearances, making victims believe they are communicating with real people. On average, thousands of online fraud cases occur each year; in 2024 alone, an estimated 6,000 cases were reported, mostly involving financial investment scams, cryptocurrency fraud, and, more recently, schemes targeting students.

These types of fraud highlight the critical importance of electronic identification, which enables accurate verification of transaction participants and traceability in the event of violations. Previously, without digital ID systems, criminals could easily create fake accounts and use false information to commit fraud on e-commerce platforms. Therefore, establishing a robust legal framework for digital identification and authentication is essential to protect consumers and businesses while ensuring the overall safety of Vietnam’s e-commerce ecosystem.

At the conference titled “Application of Identification and Authentication by the Ministry of Public Security to Enhance Safety in E-Commerce Activities” held on the afternoon of November 1, Ms. Pham Tuyet Trang, representative of the Center for Research and Application of Population Data and Citizen Identification under the Police Department for Administrative Management of Social Order, shared that in recent times, many banks, financial institutions, online service providers and airlines have collaborated with the Center to integrate and implement electronic identification and authentication services.

“Initial results have been encouraging”, Ms. Trang noted. “The electronic authentication service has recorded 42,6 million authentication transactions, including 17,8 million facial authentication instances. Meanwhile, the citizen information authentication service, which extracts data from chip-based ID cards and has been in operation since March 2023, currently has 21 first-tier agents participating, with more than 153 million transactions processed”.

In this context, digital identification and authentication are regarded as critical solutions to protect consumers and businesses while ensuring the safety of the entire e-commerce ecosystem. In practice, even with the adoption of electronic Know Your Customer (eKYC) methods, many organizations still face potential risks.

One of the most serious vulnerabilities lies in the absence of timestamps during the authentication process. Without proof of the exact time a transaction occurs, it becomes difficult to trace data in cases of disputes or violations, thereby weakening the legal validity of electronic transactions. Recent regulations now require electronic contracts to record facial images, videos, voice data, timestamps and unique identifiers of the signatories to ensure authenticity and prevent repudiation.

Another growing concern is the reuse of outdated authentication results. Many agencies or intermediaries store initial eKYC data and reuse it for subsequent transactions without re-verifying or updating information. This practice poses significant risks, as the previously authenticated individual’s data may have changed or they may have become subject to legal liabilities, updates that the system fails to capture.

The adoption of electronic and digital signatures with timestamp authentication is an effective solution to mitigate these risks. When properly implemented, digital signatures ensure integrity, authenticity, and non-repudiation, contributing to the creation of a secure, transparent and trustworthy electronic transaction environment.

Risk of counterfeiting chip-embedded ID cards

If in the past, the identification problem mainly stopped at verifying personal information, now the risk of forging identity documents, especially the citizen’s toenail chip, is becoming a big success. In fact, many online loan jobs have found the status of borrowers or stolen other people’s citizen identification cards to register for loans, creating victims with loan accounts that are not self-executed.

The root cause lies in the fact that eKYC data has not yet been verified directly from the chip managed by the Ministry of Public Security. Most online lending platforms and e-commerce sites currently only compare photos of ID documents and facial images, without checking the embedded chip data. This makes forgery easier, as fraudsters can fake documents or use photos and deepfake videos to bypass the system. Relying solely on static images without cross-referencing original data represents a serious technical vulnerability, creating opportunities for fraudulent activities.

In this context, direct data authentication from the chip has become an urgent requirement. Only when online platforms are authorized to access and verify original chip data through units licensed by the Ministry of Public Security can the accuracy and security of the identification process be truly ensured.

According to the new regulations, citizen information authentication services in chips can only be performed by units licensed by the Ministry of Public Security. Electronic contracts are required to record elements such as facial images, voice, time stamps and identification numbers of the signer. At the same time, sellers on e-commerce platforms must authenticate their identities in accordance with the law on electronic identification and authentication. This not only ensures the legal status of sellers, but also helps buyers clearly identify the transaction subjects, thereby increasing transparency and trust in the market.

Along with the legal framework, technological solutions such as remote digital signatures are also considered the “key” to building a secure digital transaction environment. Remote digital signatures allow users to sign documents on mobile devices while still ensuring authenticity, non-repudiation and data integrity. This technology not only helps reduce operating costs for businesses, but also helps management agencies trace the origin when necessary. Once data has been signed with a time-stamped digital signature, that information cannot be arbitrarily modified or copied.

However, to thoroughly address existing loopholes in electronic authentication, close inter-agency coordination is required between the Police Department on Administrative Management of Social Order and the Vietnam E-commerce and Digital Economy Agency. Establishing a mechanism for data sharing and integration between population databases and transaction data will provide a unified foundation for a national digital identification system, while also driving comprehensive digital transformation in the e-commerce sector.

Along with that, raising public awareness of the importance of electronic definitions also plays a role later. As users get used to using services such as VNeID to log in, authenticate and sign electronic contracts, the habit of safe transactions will gradually form, contributing to reducing hardships and protecting the legitimate rights of consumers.

The application of electronic identification and authentication has brought positive results, but technical and management gaps remain major barriers in the journey to building a secure digital environment. From the lack of timestamps in eKYC, the risk of reusing old authentication results, to the situation of counterfeiting chip-embedded ID cards, all show that the current authentication system still needs to be comprehensively strengthened.