The Growing Threat of SIM Swap Fraud
As cybercrime and fraud have escalated into a global crisis, one type of scheme is seeing particularly rapid growth: SIM swap fraud. The growing prevalence of SIM swap attacks highlights vulnerabilities in telecom authentication processes and underscores the need for stronger regulatory measures to protect customers. SIM swap fraud is increasingly plaguing the telecommunications industry and its customers. It was recently ranked second, behind synthetic identity fraud, among the most damaging fraud schemes affecting the telecom industry. 1. What is SIM swap fraud? SIM swap fraud is a cybercrime in which criminals gain control of a victim’s mobile phone number by fraudulently obtaining a replacement SIM card. Criminals may first collect personal information through phishing, social engineering, data leaks, or malware, and then use that information to impersonate the legitimate customer. Once the victim’s mobile number is transferred to the criminal’s SIM card, SMS messages including banking OTPs and transaction alerts can be received by the fraudster. SIM swapping requires no advanced technical expertise. Instead, it relies on the fraudster’s ability to manipulate telecom carrier employees into transferring a victim’s phone number to a SIM card under the fraudster’s control. Using basic personal information obtained from public sources or data leaks, fraudsters can carry out attacks with little more than a phone call or a visit to a retail store, without requiring coding or hacking skills. The only tools needed may be inexpensive prepaid SIM cards or burner phones. In a SIM swap attack, the attacker takes control of a legitimate subscriber’s mobile phone number by persuading the mobile telecom provider to link that number to a SIM card controlled by the attacker. SIM swapping is a legitimate procedure that serves a number of purposes, such as replacing a lost or damaged SIM card. It is also used to connect mobile phones to embedded SIMs (eSIMs), which are becoming increasingly common. In a fraudulent SIM swap, however, the attacker uses social engineering techniques to convince the telecom provider to transfer the number, impersonating the legitimate customer and claiming, for example, that the original SIM card has been lost or damaged. When the attack is successful, the legitimate subscriber’s phone loses its connection to the mobile network, preventing them from making or receiving phone calls. 2. 80% of SIM Swap Fraud Attempts Succeed Due to Weak Authentication A study by Princeton University found that 80% of first attempts at SIM swap fraud were successful. One of the main reasons for this high success rate is the use of weak authentication methods by telecom operators, which can be easily bypassed by fraudsters. While each carrier has its own vulnerabilities in the SIM replacement process, none required direct identity verification or implemented strong multi-factor authentication, allowing fraudsters to carry out remote attacks with relative ease. Telecom operators have often prioritized convenience over security, opting for simpler authentication methods to streamline customer service. In doing so, they may inadvertently create opportunities for fraudsters to exploit vulnerabilities. Lowering security standards to reduce friction for customers can ultimately weaken carriers’ defenses against SIM swap fraud. The risks become even more serious when mobile banking applications rely heavily on phone numbers and SMS-based OTPs for identity verification. If a newly registered device can be activated primarily using customer credentials and an OTP, a successful SIM swap attack may give an attacker access to the victim’s bank account. Weak device-binding mechanisms, insecure account recovery processes, inadequate session controls, and insufficient verification when registering a new device can further increase this risk. 3. SIM Swap Fraud Is Not Just a Consumer Problem SIM swap attacks are often viewed primarily as a threat to individual consumers, but they can have direct consequences for organizations as well. When an employee’s phone number is compromised, attackers can intercept one-time passwords (OTPs) sent via SMS and potentially gain access to corporate systems. This puts not only personal accounts at risk but also sensitive corporate data, financial assets, and customer records. One of the most significant concerns is account compromise through SMS-based authentication. Many organizations still rely on mobile phone numbers for password resets or two-factor authentication. If an attacker gains control of an employee’s phone number, they may be able to change login credentials for email accounts, cloud services, or financial systems often without raising suspicion until it is too late. The legal and reputational risks can be equally serious. Under the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018, organizations have obligations to protect personal and customer data. If attackers exploit weak authentication through a SIM swap attack, regulators may consider the incident in the context of data protection requirements. Beyond regulatory compliance, such incidents can also seriously undermine customer trust. 4. Measures to Prevent SIM Swap Fraud For these reasons, security experts recommend that organizations and telecom operators move away from SMS-based authentication and adopt stronger identity authentication methods, such as Identity and Access Management (IAM), authenticator applications, or hardware security keys. Banks can mitigate SIM swap fraud through measures such as strong device binding, risk-based authentication, transaction-level verification, controls over new-device registration, cooling-off periods for high-risk activities, real-time alerts, and server-side authentication and authorization controls. Customers, meanwhile, should avoid sharing OTPs, PINs, or login credentials and should never install banking-related APK files from untrusted or unknown sources. Ultimately, SIM swap fraud demonstrates why mobile banking security cannot rely on a single authentication factor. Instead, phone numbers, devices, customer identity, authentication processes, and transaction behavior should be treated as independent layers of security. SIM swap attacks clearly demonstrate why organizations need protective measures that go beyond the security standards typically applied to individual consumers. 5. Building Digital Trust Beyond SMS-Based Authentication SIM swap fraud highlights a broader challenge: digital security cannot depend on a single authentication factor – especially one tied to a mobile phone number. As digital services become increasingly interconnected, organizations need a more comprehensive approach that can establish trust across the entire digital journey—from identity verification and authentication to device security, transaction protection,
From Open Banking to Banking-as-a-Service: What Comes Next?
Over the past decade, financial innovation has evolved from open banking, which focuses on consumer-authorized data sharing, to banking-as-a-service (BaaS), which uses application programming interfaces (APIs) to make core banking functions more modular and accessible. Open banking & Open Finance The term “Open Banking” emerged around 2016 as a policy initiative aimed at increasing competition in the retail payments sector. The United Kingdom was the first country to explore this approach as a regulatory tool for promoting greater competition in digital payments through the Open Banking Implementation Entity. The idea behind these initiatives was straightforward: by making it easier for third-party providers (TPPs) to access data, regulators could lower barriers to entry, encourage competition, and create more opportunities for innovation in digital payments. A similar approach was taken by the European Union through the Second Payment Services Directive (PSD2), which came into effect in 2018. PSD2 required banks to provide registered third-party providers with access to customer account data through standardized application programming interfaces (APIs). Open Finance takes this concept a step further. While Open Banking mainly focuses on banking and payment data, Open Finance covers a much broader range of financial products and services, including credit, investments, pensions, and insurance. Under an Open Finance model, consumers can give third parties access to a broader set of financial data, potentially providing a more complete picture of their financial lives. While the potential benefits of Open Finance have not yet been fully demonstrated in practice and evidence of its impact remains limited, the concept could give consumers and businesses greater control over their financial data. By making more financial data available, Open Finance could help reduce information gaps, encourage competition, and create opportunities for more personalized financial products. These products could better reflect an individual’s financial profile, spending habits, and long-term goals. Open Finance can also make it easier for consumers to bring together and compare information from multiple providers, helping reduce complexity and make financial decisions easier. Concept of Everything-as-a-Service (XaaS) Against this backdrop, Open Banking is often seen as one of the starting points for the rise of Banking-as-a-Service (BaaS) – a new approach to financial services that brings data-driven capabilities into the way banking services are delivered. BaaS is built around the broader concept of Everything-as-a-Service (XaaS), also known as Anything-as-a-Service. XaaS refers to a wide range of cloud-based and remotely delivered services that companies can access through the Web or similar networks. The idea started with Software-as-a-Service (SaaS), where cloud providers made individual software applications available to customers. Over time, the model expanded into other services such as Infrastructure-as-a-Service (IaaS) and Communications-as-a-Service (CaaS). Eventually, the concept developed into the broader XaaS model, where businesses can access the specific services they need and pay for them on demand. In simple terms, instead of buying a software license and installing the application on individual computers, a business can subscribe to a cloud-hosted application provided by the software company. This approach gives businesses greater flexibility to switch providers while also making software maintenance easier. APIs play a key role in making this possible. They allow different applications and software systems to communicate and work with each other. As XaaS continues to grow, opportunities are also expanding for developers to build third-party applications that connect with existing platforms. The growth of SaaS, for example, has created entire businesses around developers and companies using SaaS platforms. However, APIs and SaaS are not the same thing. APIs do not require SaaS, and they have existed long before the Internet. They can also be used in offline environments. LinkedIn is an example of the SaaS model because it delivers its platform through cloud computing and generates revenue through recurring subscription fees. Facebook, on the other hand, does not operate as a SaaS company. Although it provides data through APIs, its primary source of revenue is advertising, much like Google’s core business model. Unlike SaaS providers, these platforms do not rely on subscription fees for their core services. Bank as a Service What banks can now build with APIs follows a similar XaaS approach. Banking-as-a-Service enables banks to deliver digital banking capabilities through APIs. In other words, banking services can move beyond traditional branches and become part of mobile and web-based experiences. Banks can make their data, functions, and infrastructure available through APIs, allowing other digital platforms and businesses to integrate banking capabilities into their own services. From the customer’s perspective, this can lead to very different types of digital experiences. A bank may continue to interact directly with customers, or it may operate behind the scenes as a white-label service provider. In either case, customers no longer have to interact with their bank in the traditional way. Instead, APIs allow consumers to interact with companies that may not be banks themselves, while still being seamlessly connected to regulated financial institutions through digital interfaces. While Open Banking has opened the door to greater data sharing, its role as a data-sharing mechanism can still have limitations. BaaS, meanwhile, can act as a catalyst for creating more seamless and integrated financial services in the digital economy. This model allows banks to move toward more customer-centric, platform-based business models. For traditional banks, this may also mean rethinking and restructuring how they operate. In many ways, the future of financial institutions could increasingly resemble the broader XaaS model. Making this transition possible requires a connected and collaborative ecosystem, where integration is at the core and APIs become a key enabler. Savyint provides a comprehensive Open Banking and BaaS ecosystem, backed by more than 20 years of experience in the Banking and Financial Services sector, with successful deployments for leading banks and major organizations across Vietnam and Southeast Asia (SEA). Contact us to start your banking digital transformation journey today HERE! Source: From open banking to banking-as-a-service – Nydia Remolin
Global Financial Fraud in Recent Years: Alarming Figures
Financial fraud targeting financial activities is becoming increasingly complex and sophisticated. The use of artificial intelligence (AI) by criminals, together with the widespread standardization and replication of malware and other technologies, is acting as a major driver of fraudulent activities. Financial Fraud Is Increasing Globally In INTERPOL’s March 2026 Global Financial Fraud Threat Assessment, financial fraud ranks among the top five global crime threats, with a 54% rise in fraud-related Notices and Diffusions from 2024 to 2025. Global fraud losses climb to $442 billion. The number of INTERPOL Notices and Diffusions related to fraud increased by 54% between 2024 and 2025. The sharp increase in INTERPOL alerts reflects the growing complexity and scale of cross-border fraud. Payment fraud is increasingly taking place across multiple jurisdictions, making purely domestic control measures no longer sufficient. Payment card fraud losses worldwide dipped 1.2% to $33.41 billion in 2024, according to the Nilson Report, the leading trade publication covering the global payment card industry. This fraud was tied to global card volume of $51.920 trillion. The 2026 AFP Payments Fraud and Control Survey Report provides that payments fraud remains widespread, with 76% of organizations reporting that they experienced attempted or actual fraud in 2025. Checks remain the payment method most frequently impacted by fraud. In 2025, 58% of organizations reported check fraud, outpacing ACH fraud and wire fraud. Despite long-standing awareness of check-related risks, checks continue to present persistent vulnerabilities for many organizations managing payments fraud risk. Business Email Compromise (BEC) remains one of the most common forms of payment fraud, as criminals increasingly exploit impersonation techniques to manipulate organizational processes. A 2025 study by global technology research and consulting firm Juniper Research found that e-commerce fraud is expected to increase from $56 billion in 2025 to $131 billion by 2030, representing a 133% increase over the period. This growth is driven by the rising incidence of friendly fraud, in which legitimate transactions are fraudulently disputed. Key Financial Fraud Trends AI-powered deception AI-powered manipulation is rapidly changing people’s perception of what can be considered trustworthy. Advanced AI tools can generate “deepfakes” — including realistic voices, synthetic videos, and highly personalized text — making it easier to stage scenarios that appear completely authentic, even to generations highly familiar with digital environments. As technology advances and the digital world becomes increasingly visual, victims find it more difficult to question what they see or hear. The boundary between reality and fabrication is becoming increasingly blurred. This creates an increasingly complex and unpredictable fraud landscape. According to Koren, once again, understanding human behavior has become critically important. Fraud Is Becoming More Personalized and Persistent Between 2024 and 2025, the number of fraud incidents involving social engineering increased by 33%. This method is not only growing in scale but is also undergoing a fundamental shift in its approach. To address future forms of fraud, technological expertise alone is no longer sufficient; understanding human behavior is equally essential. One clear trend is that social engineering is no longer simply a technical attack, but has evolved into a prolonged process of influencing individuals. Whereas fraud previously often consisted of a single message, we are now seeing multi-step schemes in which trust is gradually built over days or even weeks. Criminals are increasingly using psychological tactics: they spend time learning about their victims, mimicking their language and behavior, and then gradually influencing them to make decisions that ultimately harm themselves. The Professionalization of Fraud Tools One clear emerging trend is the professionalization of fraudulent online storefronts. Scam websites have evolved significantly: they are no longer crude and poorly designed sites, but professionally built platforms with convincing e-commerce interfaces and close integration with digital marketing channels such as Facebook. Fraudsters can quickly create new stores with a trustworthy appearance within just a few hours, while flexibly adapting their visuals and messaging with remarkable sophistication. One alarming trend that Recorded Future called out is the increasing industrialization of support services and technology that allows fraudsters to maximize their effectiveness. One such popular tool allows scam operators to rewrite the code on an online retailer’s payments page and then steal, or “skim,” payment information as transactions happen in attacks called Magecart. The report points out that there were 10,500 such hacks active in 2025, leading to the compromise of over 23 million online transactions. These highly professional fraudulent commercial environments play a critical role in the constantly evolving fraud economy, targeting online shoppers through highly convincing storefront interfaces. Cross-Border and Distributed Fraud Operations We are also seeing a significant increase in cross-border fraud activities, particularly in the movement of illicit funds. Transactions are distributed across multiple countries, with participants — including both willing participants and individuals who are manipulated or unaware of the scheme — being used to break transaction flows into smaller segments, making them more difficult to trace. The recruitment of “money mules” often relies on psychological tactics involving financial pressure, social influence, and emotional manipulation. The “fraud economy” is becoming increasingly professionalized and global, while also becoming far more adaptable and resilient. Savyint Fraud Detection and Prevention Solutions With more than 20 years of experience in cybersecurity, information security, and cyber safety, particularly in the financial and banking sectors, Savyint has developed a comprehensive ecosystem of solutions for fraud detection, payment security, identity, authentication, and system access control. We leverage AI, AI agents, and the latest security standards to detect and respond to fraud, ensuring that every transaction conducted in our customers’ digital environments is protected in real time and capable of withstanding evolving and increasingly sophisticated forms of fraud over the long term. Our solution ecosystem includes: Contact us today for expert consultation HERE! Reference: https://www.helpnetsecurity.com/2026/03/18/online-fraud-victims-losses-interpol-report https://www.tietoevry.com/en/blog/2026/04/five-payment-fraud-trends-to-monitor https://www.mastercard.com/global/en/news-and-trends/stories/2026/recorded-future-annual-payment-fraud-report.html https://www.financialprofessionals.org/training-resources/resources/survey-research-economic-data/details/payments-fraud The Nilson Report
Open Banking: APIs, Data, and User Consent
Open Banking is the development of a new financial ecosystem based on connections between financial institutions and businesses, supported by APIs. Financial institutions are enabling third parties to integrate services, provide access to banking data, and deliver entire banking services through APIs. So how can APIs, data, and user consent be managed and protected? Key Characteristics of Open Banking Open Banking focuses on serving consumers, with API or SDK technology as its core foundation and operates within the financial ecosystem. Open Banking has three key characteristics: data portability, customer autonomy, and recipient accountability. The International Organization for Standardization (ISO) defines data portability as “the ability to easily transfer data from one system to another without having to re-enter the data.” Based on this definition, in Open Banking, consumers can share their relevant banking data with third-party providers (TPPs), in line with “data portability.” Data portability in Open Banking is supported by standardized and interoperable data technologies, primarily APIs. This is a fundamental principle of liberal democracy, in which marketers are permitted to influence customers but must respect their autonomy. Open Banking empowers customers to control the sharing of their banking data, and this right is supported by customers’ legal rights to share data through Open Banking. Open Banking requires recipients of customers’ banking data (TPPs) to be accountable to customers. Therefore, Fintech companies receiving banking data must be responsible for protecting this data from leakage, theft,… This is why strict management of TPPs through a regulatory system is very important. In summary, these three characteristics of Open Banking all reflect the goal of improving competitiveness, promoting innovation, and strengthening consumer protection. Solutions for Managing APIs, Data, and User Consent With many years of experience in developing security solutions as well as specialized solutions for the Financial – Banking sector, Savyint has developed an Open Banking Tech Stack solution that enables banks to comply with the current legal regulations of each country (such as EU PSD2/3, Philippines AFASA, BSP Circular No. 1213 – 1215, Vietnam Circular No. 64, Circular No. 50, Circular No. 77…), ensuring end-to-end security across API protection, payment, data sharing, and consent management operations. In particular, the solution is flexibly designed by Savyint according to scale, prioritizing the use of existing security infrastructure: small banks can deploy it in a simple and lightweight manner; large banks can scale up to a highly redundant model, ensuring continuous and stable operations even in the event of incidents. Contact us now for consultation HERE!
SAVYINT Provides Core Electronic Transaction Authentication Platform for LPBank
Overview – Industry: Banking & Financial Services – Customer: LPBank – Project: Deployment of SmartOTP for LPBank’s retail customers and internal users SAVYINT successfully provided the core electronic transaction authentication platform (SmartOTP) for LPBank, enabling secure, convenient, and seamless transaction authentication directly within the bank’s digital banking application. The solution strengthens security for both financial and non-financial transactions, reduces reliance on SMS OTP, and supports LPBank in meeting the requirements of Circular No. 50/2024/TT-NHNN and Circular No. 77/2025/TT-NHNN issued by the State Bank of Vietnam. LPBank’s Need for Enhanced Authentication Security in Digital Banking Established in 2008, LPBank has built an extensive network across 34 provinces and cities and is one of the 14 banks classified among the credit institutions of systemic importance within Vietnam’s banking system. Amid growing risks related to impersonation, credential theft, and transaction fraud, as well as the regulatory requirements under Circular No. 50/2024/TT-NHNN and Circular No. 77/2025/TT-NHNN on strengthening security and safety in the provision of online banking services, LPBank – with more than 5 million individual customers using digital banking services – required an authentication solution that complies with State Bank of Vietnam (SBV) regulations and can operate at scale while ensuring strong security, ease of use, and flexible integration with its existing digital banking infrastructure. At the same time, LPBank needed to strengthen the centralized administration and operation of its authentication system. Activities such as service activation, SmartOTP status management, exception handling, authentication history lookup, and transaction monitoring needed to be managed centrally, transparently, and with full traceability. To address these requirements, LPBank selected SAVYINT SmartOTP as its core transaction authentication platform, working with SAVIS as the integration and implementation partner to integrate the solution into its digital banking ecosystem. This enables LPBank to progressively reduce its reliance on traditional SMS OTP while establishing a secure and scalable authentication foundation aligned with its long-term digital banking strategy. The SAVYINT Solution With extensive experience in authentication and security solutions for the Banking & Financial Services sector, SAVYINT provides SmartOTP as the core technology platform for electronic transaction authentication, comprising the following key components: 1. SmartOTP SDK Integrated Directly into the Mobile Banking Application The SmartOTP SDK is integrated directly into the LPBank Plus mobile banking application. Through the SDK, the Mobile Banking application can invoke SmartOTP functions at authentication checkpoints throughout the customer transaction journey. Customers can activate SmartOTP, use biometric authentication where supported, authenticate transactions, and manage their SmartOTP settings directly within the LPBank Plus application. This enables a fast, convenient, and seamless authentication experience while strengthening the bank’s ability to manage transaction risks across its mobile banking channel. 2. Admin Portal for Centralized Administration and Operations The Admin Portal provides bank staff with centralized capabilities to monitor customers’ SmartOTP status, retrieve authentication information, review OTP transaction history, and handle operational incidents. The Admin Portal enables centralized management of SmartOTP-related operations, including: The platform also supports monitoring, investigation, and traceability when required, helping strengthen risk management capabilities and maintain transparency throughout system operations. Deployment Roadmap The project was implemented in phases: Key Use Cases SmartOTP Activation and Service Management Transaction Authentication with SmartOTP PIN Management and Security Controls Administration and Operations through the Admin Portal Monitoring, Logging, and Traceability Helping LPBank Strengthen Transaction Security and Customer Experience While Meeting the Requirements of Circular No. 50/2024/TT-NHNN and Circular No. 77/2025/TT-NHNN Officially going live in June 2026, SmartOTP enables LPBank customers to authenticate transactions directly within the Mobile Banking application, delivering a faster, more convenient, and seamless authentication experience. For LPBank, the solution strengthens transaction risk management, reduces reliance on SMS OTP, enables centralized administration through the Admin Portal, and provides a scalable foundation for more advanced authentication requirements in the future. The function-based SDK integration model also enables flexible integration, easier maintenance, and long-term alignment with the bank’s digital banking ecosystem. At the same time, LPBank has met the requirements under Circular No. 50/2024/TT-NHNN and Circular No. 77/2025/TT-NHNN issued by the State Bank of Vietnam, with the solution applied consistently to individual customers. This provides an important foundation for LPBank to strengthen Digital Trust, protect transactions, and enhance the customer experience throughout its digital banking journey.
SAVYINT Showcases Post-Quantum Digital Trust Solutions at the International Conference: “Shaping the Future of PKI Infrastructure: Transitioning Cryptographic Standards for Trust Services into the Post-Quantum Era”
On July 21, in Hanoi, the National Electronic Authentication Center (NEAC) under the Ministry of Science and Technology hosted the international conference “Shaping the Future of PKI Infrastructure: Transitioning Cryptographic Standards for Trust Services into the Post-Quantum Era.” At the event, SAVYINT demonstrated its forward-looking vision by showcasing its comprehensive Digital Trust solutions powered by Post-Quantum Cryptography (PQC). The Post-Quantum Era and New Challenges for Digital Trust The conference was held at a time when countries around the world are accelerating research and preparations for the impact of quantum computing on digital infrastructure. While quantum computing promises unprecedented computational capabilities, it also presents significant challenges to the cryptographic mechanisms currently used to safeguard data, digital identities, and electronic transactions. During the conference, experts discussed emerging trends and challenges in trust services, shared international experiences in modernizing PKI infrastructure, enhancing crypto agility, and preparing migration roadmaps toward next-generation security technologies to ensure digital trust in the post-quantum era. Digital Trust Infrastructure as the Foundation of the Digital Economy In her opening remarks, Ms. To Thi Thu Huong, Director General of the National Electronic Authentication Center (NEAC), emphasized that Vietnam is entering a period of rapid development in its digital economy, digital society, and digital government. In this transformation, Public Key Infrastructure (PKI), digital signatures, and trust services serve as the foundation for electronic identity authentication, data integrity, and trust in digital transactions. Proactively studying international standards, adopting global best practices, and preparing for future cryptographic transitions will not only help maintain digital trust and protect electronic transactions, but also facilitate cross-border interoperability and mutual recognition of trust services, supporting Vietnam’s international integration in the digital era. Three Major Challenges Facing Digital Trust Infrastructure in the Next Decade At the conference, domestic and international experts highlighted three critical challenges that are reshaping digital trust infrastructure worldwide. First, the rapid advancement of quantum computing requires a transition to new cryptographic standards capable of protecting data, digital identities, and electronic transactions in the future. Second, the explosive growth of cloud computing, artificial intelligence (AI), the Internet of Things (IoT), and large-scale digital systems is dramatically increasing the number of digital certificates, connected devices, and trust services requiring authentication, making PKI modernization an urgent priority. Third, the global trend toward shorter digital certificate lifecycles, aimed at strengthening cybersecurity, is placing increasing pressure on certificate lifecycle management and operational efficiency. Experts agreed that the transition to the post-quantum era is not merely a technological challenge, but also one of governance, standardization, and organizational adaptability in an increasingly digital world. One of the key concepts highlighted during the conference was Crypto Agility – the capability that enables systems to seamlessly adopt and transition between cryptographic algorithms. Experts emphasized that adopting Hybrid Cryptography represents the most practical and strategic approach for Certification Authorities (CAs) in Vietnam to gradually migrate to post-quantum security while ensuring uninterrupted operation of existing systems. Strengthening Cryptographic Security Mr. Hoang Nguyen Van, Vice President of theVietnam Institute for Digital Transformation and Innovation (VIDTI), pointed out that the threat posed by quantum computing is no longer a distant concern – it is becoming a reality. Once sufficiently powerful quantum computers emerge, many of today’s cryptographic algorithms protecting government systems, national defense, financial services, banking, healthcare, and other critical infrastructures could be broken. Every nation is facing this security challenge. As economies become increasingly digital, the issue extends beyond protecting data – it is about safeguarding digital sovereigntyandtechnological sovereignty. “Long-lived data with retention periods of 25 to 30 years – such as financial records, strategic assets, public service contracts, and healthcare data faces a significant risk if not protected by next-generation cryptographic standards. Such data could be collected today and decrypted in the future through ‘harvest now, decrypt later’ attacks,” Mr. Hoang Nguyen Van stated. He also proposed a reference roadmap for the 2026 – 2030 period, including: Conducting a comprehensive inventory of cryptographic assets, assessing cryptographic risks, piloting new algorithms and deployment models; and gradually building national capabilities in post-quantum cryptography to safeguard data, electronic transactions, and financial security in the years ahead. According to Mr. Hoang Nguyen Van, the guiding principle for this transition should be “Crypto-Agility First.” This approach enables organizations to update cryptographic algorithms flexibly while maintaining interoperability and minimizing operational disruption when traditional algorithms are no longer considered secure. He further emphasized that the migration extends far beyond replacing cryptographic algorithms. It requires comprehensive modernization across the entire IT ecosystem, including network infrastructure, servers, authentication systems, operational processes, and business applications. To ensure security throughout the transition period, he recommended adopting a Hybrid Cryptography model that combines today’s widely deployed algorithms with quantum-resistant algorithms such as lattice-based cryptography. SAVYINT Brings Post-Quantum Digital Trust Technologies to Vietnam and the Region More than just delivering technology, SAVYINT provides a comprehensive Digital Trust platform that empowers organizations to protect their most valuable data and critical digital assets – both today and in the post-quantum future. SAVYINT’s Digital Trust portfolio addresses the full spectrum of enterprise security and trust requirements while meeting the specialized needs of highly regulated industries such as banking and financial services. Its solution portfolio spans Data Security & Cryptography, Digital Identity & Fraud, and Secure Payment. Post-Quantum Cryptography (PQC) is a foundational technology embedded across many of SAVYINT’s solutions. While awareness of post-quantum security remains relatively limited among many organizations, SAVYINT has proactively integrated globally standardized PQC algorithms into its existing platforms. This enables both existing and new customers to benefit from the latest cryptographic innovations while ensuring that their data and electronic transactions remain protected over the long term – regardless of future algorithm transitions or emerging cyber threats. – SAVYINT SAM FIDO2 Identity Server is a passwordless mobile authentication and identity solution based on the FIDO2 standard, combining data encryption and transaction security. The solution ensures compliance with requirements for blockchain, cryptocurrency, mobile payments, data encryption, transaction encryption, system security, and authentication, addressing the security demands of modern digital ecosystems. – SAVYINT SAM Auth Server is an all-in-one solution for strong authentication data encryption, digital signature
SAVYINT Officially Joins the Cloud Signature Consortium (CSC): Advancing the Global Digital Trust Ecosystem
March 2026, SAVYINT has officially become a member of the Cloud Signature Consortium (CSC) – the world’s leading international standardization body in the field of cloud-based digital signatures and digital trust services. As the global digital economy undergoes profound shifts in both regulatory frameworks and technical standards, establishing common benchmarks for cross-border electronic transactions has become an urgent priority. SAVYINT – a pioneer in security and trust services – has officially joined the Cloud Signature Consortium (CSC). This milestone reaffirms SAVYINT’s position and commitment to aligning its digital signature and authentication solutions with the highest international standards. Trust with Cross Border As a CSC member, SAVYINT’s Chairman of the Board, Mr. Steve Huang, made a notable introduction at the CSC online networking session themed “Trust with Cross Border — The EU–Mercosur Free Trade Agreement and Its Impact on the Digital Trust Ecosystem”. During the session, leading experts shared insights on the opportunities and challenges in advancing global interoperability for cross-border digital signatures. For SAVYINT, participating in these international dialogues is not only an opportunity to stay current with the most advanced technical specifications, but also a chance to connect with strategic partners across Europe and Latin America — laying the groundwork for SAVYINT’s international market expansion strategy. SAVYINT – Leading Digital Trust Solutions in the Region SAVYINT Group is a premier IT security company headquartered in Australia, with a Research & Development (R&D) center based in Vietnam. With a strategic focus on building market-adaptive digital trust infrastructure, SAVYINT has developed a comprehensive suite of solutions including: Qualified Remote Signing, VA & Timestamp, PKI in a Box, SAM Appliance, ePaperless, eStamping, and eArchive. All platforms are entirely researched and developed in-house, ensuring high flexibility and customizability to meet the distinct legal frameworks and trust requirements across regional markets including SEA, APAC, and MENA, as well as international standards such as PSD2/PSD3, eIDAS, GDPR, and beyond. Looking further ahead, SAVYINT is also committed to realizing a roadmap toward post-quantum-ready trust services, encompassing PQC-enabled cryptographic infrastructure and PKI. As a member of CSC, SAVYINT commits to long-term contributions to the digital trust community, synchronizing with international standards, sharing real-world implementation experience, and offering practical perspectives from Vietnam and other emerging markets to help make CSC’s standards more comprehensive and reflective of the world’s diverse realities. Digital trust knows no borders, and joining CSC is the foundation upon which SAVYINT will realize that vision on a global scale.
From AFASA to BSP Circulars 1213 – 1215: SAVYINT Partners with Philippine Banks to Strengthen Security and Fight Digital Fraud
The rapid growth of digital banking, e-wallets, and online payments in the Philippines has led to a serious consequence – financial fraud is becoming increasingly sophisticated and more organized. Following the enactment of AFASA, the Bangko Sentral ng Pilipinas (BSP) continued to issue BSP Circulars 1213, 1214, and 1215, tightening the responsibilities of financial institutions and imposing stricter requirements for user authentication, fraud management, and data protection. About AFASA and BSP Circulars 1213, 1214, and 1215 Officially taking effect on June 25, 2025, the Anti-Financial Account Scamming Act (Republic Act No. 12010) was enacted by the Philippine government with the following core objectives: One of the most important requirements under AFASA is the mandatory transition of authentication methods before June 2026. OTPs sent via SMS and email will no longer be accepted for high-risk transactions. Instead, more secure methods must be implemented, such as biometric authentication, passwordless authentication, and adaptive multi-factor authentication (MFA) based on risk levels. AFASA marks a major shift in risk management thinking: account security is no longer just a technology choice – it is now a legal obligation. BSP Circular 1213 – Focus on Fraud Management and Strong Authentication Among the three circulars, BSP Circular 1213 is considered the technical backbone that brings AFASA into real operational practice. This circular requires banks and financial institutions to: BSP Circular 1213 clearly states that traditional authentication methods are no longer sufficient. Systems must understand user behavior patterns and detect fraud at the earliest stages – during login or even before a transaction is completed. Read more: Philippines BSP Circular No. 1213 and Compliance Solutions for Financial Institutions BSP Circular 1214 – Enabling Data Sharing for Faster Fraud Response BSP Circular 1214 addresses a major legal bottleneck related to accessing account data during fraud investigations. Its main goal is to create a fast-response mechanism to prevent funds from being completely withdrawn before authorities can intervene. Under this regulation: BSP Circular 1215 – Protecting Funds During Disputes While Circular 1213 focuses on prevention and 1214 focuses on investigation, BSP Circular 1215 addresses what happens after an incident occurs. It allows financial institutions to protect customer funds during the investigation period, preventing money from “disappearing” within minutes. Specifically, this circular: Together, AFASA and BSP Circulars 1213, 1214, and 1215 are reshaping the digital financial security standards in the Philippines. Financial institutions now need not only compliance documentation but also a strong technology foundation capable of detecting, preventing, and responding to fraud in real time. AFASA & BSP 1213, 1214, 1215 – Compliant Security Solutions from SAVYINT Savyint is a leading trusted service provider, ready to deliver authentication and payment security solutions that strictly comply with security standards and regulatory requirements under AFASA, BSP Circulars 1213, 1214, and 1215 issued by the Bangko Sentral ng Pilipinas (BSP), as well as the Philippine Open Banking framework and international regulations. Savyint’s solution ecosystem is built around four key pillars: Risk Management & Compliance, Cybersecurity & Application Protection, SCA/MFA Identity, and the FMS AI Fraud Engine. Together, these components protect the entire customer journey – from registration, login, authentication, and transaction execution to post-transaction monitoring. SAM Auth Server SAM Auth Server is an all-in-one strong authentication solution designed for mobile payments and digital banking. Built on a Zero Trust architecture and integrated with a FIPS 140-3 Level 3 certified Hardware Security Module (HSM), and ready for Post-Quantum Cryptography, SAM Auth Server supports a wide range of modern authentication methods, including: Biometric authentication, Smart OTP, Push Authentication, FIDO2 / Passkeys and Context-based authentication It enables step-up authentication when risk levels increase, ensuring maximum protection for electronic transactions. SAM FIDO2 Identity Server SAM FIDO2 Identity Server is a passwordless identity and authentication platform based on FIDO2/WebAuthn standards. It eliminates password storage by replacing passwords with asymmetric key-based authentication securely stored on the user’s device.As a result, the system effectively protects against common attacks such as phishing, man-in-the-middle attacks, and credential stuffing. SAM FIDO2 Identity Server fully meets Strong Customer Authentication (SCA) requirements under PSD2/PSD3 and complies with international standards for identity and data security. SAVYINT Fraud Prevention & Risk Management SAVYINT Fraud Prevention & Risk Management leverages AI and Machine Learning (ML) to help banks and financial institutions detect, assess, and prevent fraud across the entire user journey – from login behavior, device characteristics, and access context to transaction data. Key capabilities include: RASP+ RASP+ protects mobile applications directly within the runtime environment, detecting and blocking attacks while the application is running. It can detect rooted or jailbroken devices, debugging attempts, code tampering, hooking techniques, memory manipulation and emulator-based attacks. RASP+ integrates directly into mobile applications without affecting performance, ensuring strong protection without compromising user experience. TrustShield TrustShield is a mobile fraud prevention platform powered by device fingerprinting, behavioral analytics, and AI. It can identify devices without relying on cookies or advertising IDs, detect emulators, rooted or jailbroken devices, identify multi-device fraud patterns, analyze in-app user behavior, generate real-time risk scores and trigger adaptive authentication directly on mobile devices. With a multi-layered architecture and seamless integration capabilities, Savyint’s security ecosystem delivers a comprehensive fraud prevention model – protecting devices, behavior, identity, and transactions simultaneously. All solutions comply with AFASA, BSP Circulars 1213, 1214, 1215, and international standards such as FIDO2, PSD2/PSD3, eIDAS, GDPR, and PCI DSS. This allows fast deployment on existing infrastructure while achieving the highest level of security. Connect with Savyint’s experts today to implement and optimize your security solutions – and be fully prepared to meet AFASA and BSP requirements within just 3 months!
Financial Fraud Prevention: Protecting Assets, Data and Customer Trust
Proactive financial fraud prevention not only helps minimize losses but also plays a critical role in maintaining seamless customer experiences and improving overall operational efficiency. As fraud schemes become increasingly sophisticated, faster, and larger in scale, traditional control measures are no longer sufficient. Financial fraud prevention is therefore no longer merely a matter of compliance or security – it has become a strategic priority that enables organizations to optimize processes and ensure sustainable growth. 1. Benefits of Financial Fraud Prevention Implementing robust fraud prevention measures not only safeguards customers and organizations but also supports long-term, sustainable business growth. a. Minimizing financial losses Fraud can cause significant damage even when incidents occur on a small scale. Effective preventive measures help organizations reduce the risk of loss, control costs, and build a solid financial foundation for long-term development. b. Optimizing revenue and transaction processing efficiency One direct benefit is the improvement of authorization rates by reducing false declines of legitimate transactions – a common challenge in online payments. When transactions are processed accurately and quickly, completion rates increase, enabling businesses to maximize revenue. c. Protecting customer data and digital assets In the financial and banking sector, protecting personal information and financial data is essential to maintaining customer trust. Account Takeover (ATO) attacks and card data theft not only result in financial losses but also severely damage an organization’s reputation. By proactively preventing fraud, organizations can detect and stop these threats early, before real damage occurs. d. Enhancing customer experience Customers increasingly expect transactions to be smooth, uninterrupted, and free from unnecessary verification steps. Reducing fraud also means reducing unnecessary transaction rejections, leading to better customer experiences while lowering operational pressure and costs for businesses. e. Preserving brand reputation As noted above, even minor fraud incidents can erode customer trust and negatively impact brand image. Investing in comprehensive fraud prevention demonstrates a strong commitment to security and customer protection, helping organizations build a trusted and credible brand over the long term. 2. Effective Fraud Prevention with Savyint Fraud Prevention and Risk Management With these benefits in mind, a comprehensive and effective fraud prevention system enables banks and financial institutions to minimize losses, strengthen transaction protection, ensure customer data security, and enhance long-term operational efficiency. This is precisely the objective of Savyint Fraud Prevention & Risk Management (FPRM). Built on a Zero Trust architecture, Savyint FPRM enables organizations to proactively prevent fraud while integrating risk management and transaction security. The solution leverages AI and Machine Learning for behavioral analysis, combined with strong authentication mechanisms such as SCA, multi-layer MFA, and biometrics, along with advanced security technologies including tokenization and Post-Quantum Cryptography (PQC). This enables: As a result, organizations can detect, prevent, and respond to fraud effectively before losses occur. Savyint Fraud Prevention & Risk Management (FPRM) also complies with global standards such as AML, KYC, KYB, PSD2, PSD3, and PCI-DSS, as well as local regulatory requirements including Circulars 64 and 50 (Vietnam), BSP 1213 (Philippines), and regulations in Malaysia. Connect with Savyint experts today for detailed consultation on a fraud prevention roadmap tailored to your organization’s business model!