Vietnam: Personal Data Security When Integrating with VNeID – What Should Businesses Do?
In Vietnam, connecting to and verifying information through the VNeID application has officially become a core form of digital identification, serving as the “digital identity” of each citizen in the electronic environment. However, as identity data is shared and utilized in the digital environment, businesses and organizations must also ensure that user data is properly managed and used. 1. Personal data protection: From “recommendation” to “mandatory requirement” Effective from January 1, 2026, the Personal Data Protection Law No. 91/2025/QH15 establishes a new legal framework for the collection, processing, and protection of personal data. Subsequently, Decree No. 320/2026/ND-CP, effective from September 28, 2026, further requires the connection and use of electronic identification and authentication across multiple sectors. Specifically: However, authentication through VNeID does not mean that organizations have the right to use all citizens’ data for every purpose. Under Vietnam’s Personal Data Protection Law, users have the right to know and request transparency regarding: The measures used to protect data against unauthorized access, use, or disclosure. Therefore, businesses and organizations also need to implement the necessary platforms and systems to safeguard users’ rights regarding the sharing of personal data, while supporting record-keeping and reporting when required. 2. Legal compliance needs to be translated into technical controls Personal data protection cannot stop at internal procedures or written policies. Vietnam’s personal data protection regulations have established clearer requirements regarding organizational responsibilities in cases involving personal data breaches and cybersecurity incidents. Specifically, the 2025 Personal Data Protection Law together with Decree No. 330/2026/ND-CP provides for administrative penalties in the areas of cybersecurity and personal data protection. Depending on the nature and severity of the violation, organizations and individuals may face: The collection, storage, use, provision, or sharing of data for improper purposes, without an appropriate legal basis, or without adequate data protection measures may also expose organizations to unnecessary legal risks. 3. What should businesses and organizations do to ensure user data security when integrating with VNeID? When data generated through electronic identification and authentication is incorporated into business processes, the responsibility for protecting that data does not stop at the point of connection with VNeID. Companies and organizations need to establish end-to-end data control mechanisms covering data collection, transmission, processing, storage, sharing, and the destruction or deletion of data in accordance with applicable regulations. Businesses should: Proactively protecting users’ personal data is not only a legal requirement but also an opportunity for businesses to strengthen risk management, prevent fraud, and protect their long-term reputation. To meet the requirements for personal data protection, strong authentication, and traceability when integrating with VNeID, businesses need a security architecture capable of maintaining control throughout the entire data lifecycle. With more than 22 years of experience in cybersecurity and digital trust, SAVYINT provides a comprehensive Digital Trust & Cybersecurity ecosystem with solutions such as Multi-Factor Authentication (MFA), Strong Customer Authentication (SCA), FIDO2 Identity, Post Quantum Identity & Authentication, Transaction Signing, data encryption, Tokenization, and API Security. These solutions help businesses strengthen access control, protect sensitive data, and enhance their ability to meet requirements for data security, traceability, and regulatory compliance in Vietnam. Contact with SAVYINT experts HERE.
Vietnam Seeks to Elevate Electronic Identification and Authentication Regulations into Law
For many years, electronic identification in Vietnam has largely been viewed as a tool to support the delivery of administrative procedures in the digital environment. For most citizens, electronic identification has been closely associated with the VNeID application, digital driving licences, or access to online public services without the need to present physical documents. However, the proposals put forward by the Ministry of Public Security as part of the development dossier for the Law on Electronic Identification and Authentication indicate that the scope and ambition of this policy extend far beyond that. If approved by the National Assembly of Vietnam, the legislation would not merely govern electronic identification accounts or the VNeID application. More broadly, the draft law seeks to establish a national digital identity infrastructure in which not only individuals but also organizations, goods, assets, data, software, locations, transactions, and other entities within the digital economy can be identified, authenticated, and traced in the electronic environment. This represents an important shift in national governance — from traditional administrative management toward data-driven governance in the digital age. Electronic Identification Is Becoming Essential National Infrastructure Globally, electronic identification and authentication are increasingly regarded as core infrastructure for the digital economy. The European Union is implementing the European Digital Identity Framework (eIDAS 2.0) alongside the European Digital Identity Wallet, enabling citizens to use a unified digital identity when conducting transactions across member states. Estonia has long served as a model for digital government, with almost all public services operating on the basis of its electronic identification system. Singapore has developed the Singpass ecosystem to serve both the public and private sectors, spanning banking, insurance, real estate, and other services. Meanwhile, India operates Aadhaar with more than 1.4 billion digital identities, widely regarded as the world’s largest electronic identification system. The common thread across these models is that electronic identification is no longer viewed as a standalone technological utility. Instead, it has become an operational foundation for digital government, the digital economy, and digital society. Current international trends are moving even further beyond human identification. The European Union is implementing the Digital Product Passport, under which each product is assigned a unique electronic identifier to support traceability and lifecycle management. New international standards are also expanding the scope of identification to goods, assets, data, devices, applications, and many other types of entities in the digital environment. It is against this backdrop that the Ministry of Public Security considers it necessary for Vietnam to establish a legal framework with greater legal authority, enabling the country to keep pace with global developments and meet the requirements of national digital transformation. Regulations Are No Longer Sufficient for the Next Stage of Development After more than three years of implementing Decree No. 59/2022/ND-CP and Decree No. 69/2024/ND-CP, Vietnam’s national electronic identification system has achieved notable results. However, according to the Ministry of Public Security, Vietnam has now moved beyond the initial stage of electronic identification. Previously, the primary focus was on establishing digital identities for citizens and organizations. Today, the scope of governance requirements is considerably broader. In the digital environment, identifying people alone is no longer sufficient. The State needs the ability to identify vehicles, goods, locations, data, software, digital assets, and many other types of objects to support governance, transactions, and the development of the digital economy. Meanwhile, regulations relating to identification are currently scattered across multiple laws and subordinate legal instruments, including the Law on Identification, the Law on Electronic Transactions, the Law on Data, the Law on Digital Technology Industry, and various sector-specific regulations. This fragmentation creates significant challenges. For state management agencies, the absence of a unified legal framework limits the ability to ensure data interoperability across ministries, sectors, and local authorities. For businesses, compliance with multiple authentication mechanisms increases both compliance costs and transaction costs. For citizens, repeatedly providing and verifying information — even when the data already exists within government systems — reduces the efficiency of the digital transformation process. The development of a unified law is therefore expected to establish a common “language” for Vietnam’s entire digital identity and data ecosystem. Legal Recognition of Digital Identity and Reduced Reliance on Physical Documents Another important driver behind the development of the law is the need to strengthen the legal foundation for the use of electronic documents. In recent years, VNeID has integrated various types of documents, including identity cards, driving licences, vehicle registration certificates, health insurance information, and other documents. However, the number of documents integrated into the system remains limited compared with practical needs. Many agencies and organizations still require citizens to present physical documents even when the relevant information has already been authenticated through electronic systems. This situation reflects a fundamental issue: current legislation does not yet provide sufficiently comprehensive legal recognition of digital identities and electronic documents. In the absence of a sufficiently strong legal basis, many agencies continue to adopt the safer approach of requiring paper – based documentation rather than relying entirely on electronic data. Accordingly, one of the key objectives of the draft law is to establish clear legal status for digital identities, electronic documents, and electronic authentication results. If implemented effectively, this could provide the foundation for significantly reducing administrative paperwork, lowering compliance costs, and shortening the time required to process procedures for citizens and businesses. Electronic Identification Is Not Limited to Public Services A notable aspect of the draft legislation is that electronic identification is designed not only to support government operations but also to facilitate transactions within the private sector. In finance and banking, a unified electronic identification system could significantly reduce customer verification costs, improve the efficiency of eKYC processes, and help mitigate fraud. In e-commerce and logistics, the identification of goods and products could support traceability, combat counterfeit products, and enhance supply-chain trust. For data and digital assets, establishing electronic identities for data and intangible assets could provide a foundation for new data-driven business models. In other words, the draft law would not only affect public administration but
From Open Banking to Open Finance and Open Data
The Open Banking ecosystem is expanding rapidly, bringing significant and positive changes to the global financial landscape. The world is now ready to witness the next chapters in the evolution of Open Finance and Open Data. In fact, Open Banking emerged somewhat unexpectedly. In the UK, as Fintech companies began entering the retail payments market, there were initially no specific regulations governing how these parties should collaborate or operate within the ecosystem. A study conducted by the UK Competition and Markets Authority (CMA) found that the UK retail banking sector was highly concentrated, with limited competition. These findings provided a major impetus for the introduction of Open Banking regulations and similar initiatives worldwide, aimed at enhancing competition and driving economic growth. This led to the emergence of Open Banking, with its principles and requirements formally established under the European Parliament’s PSD2 Directive and, more recently, the proposed PSD3 framework. Key roles were also clearly defined, including Account Information Service Providers (AISPs), which aggregate users’ financial data from multiple accounts, and Payment Initiation Service Providers (PISPs), which enable payment services across accounts. The emergence of Open Banking has encouraged banks to invest in API technology and establish partnerships with Fintech organizations across Europe. Nordic banks were among the earliest and most enthusiastic adopters of this model. Digital Identity as an Enabler of Open Finance and Open Data The Nordic countries provide a compelling example of how digital identity can be adopted in banking for commercial purposes. As digital identity solutions become widely used across the region, they help accelerate customer authentication and streamline digital financial services. This has enabled Fintech companies not only to compete with traditional banks, but also to challenge credit and debit card providers, whose services have traditionally faced limitations in online customer information management. Beyond authentication, digital identity provides a trusted foundation for Open Finance and Open Data. By enabling secure identification, reliable authentication and consent-based data sharing, digital identity solutions can help users access financial services across multiple providers while maintaining control over their personal information. Integrated with secure APIs and consent management platforms, digital identity can support trusted data exchange among banks, Fintech companies and other authorized third parties, paving the way for more connected, interoperable and user-centric financial ecosystems. Open Data Enables Competition and Drives Innovation Following its implementation and widespread adoption, Open Banking has developed more rapidly than initially anticipated. Today, users can authorize banks to share their transaction histories, identification images and other relevant information with other banks or third-party providers of their choice. They can also switch accounts, apply for loans or obtain credit cards from new providers with greater ease. In addition, users can manage their financial histories through a single platform, eliminating the need to switch between multiple applications. This transformation is gaining momentum as new players enter the ecosystem. In the future, organizations outside the financial sector will also leverage Open Data to deliver highly personalized products and services, while allowing users to retain control over their own data. These new market participants will make it easier for users to discover and access services that meet their specific needs. Ultimately, services that significantly reduce time and costs will be well positioned to attract and retain users. Open Data – An Opportunity for Early Movers From the perspectives of regulators and users alike, the transition to Open Banking and Open Finance is not something that can be achieved overnight. It requires a continuous, long-term process. Greater attention will also be needed as new technological initiatives around Open Data emerge. For Open Data to drive meaningful and positive change, clear regulatory frameworks and legal standards are essential. This requires concerted efforts from regulatory authorities, as well as closer international cooperation to establish common standards and requirements for secure, compliant data exchange across borders. In conclusion, the world is witnessing the continued growth of Open Banking and the benefits it brings. It is now time to set the next goals for the era of Open Finance and Open Data. While this transformation will take time, it will serve as a powerful catalyst for global economic and technological development. SAVYINT – Comprehensive Open Banking Solutions SAVYINT provides a comprehensive Open Banking solution ecosystem, encompassing data management, Digital Identity and trusted digital services. Backed by more than 20 years of experience in the Banking and Financial Services sector, SAVYINT has successfully deployed solutions for leading banks and major organizations across Vietnam and Southeast Asia (SEA). The solution portfolio includes: Contact us today to consult with our leading Open Banking experts HERE!
The Growing Threat of SIM Swap Fraud
As cybercrime and fraud have escalated into a global crisis, one type of scheme is seeing particularly rapid growth: SIM swap fraud. The growing prevalence of SIM swap attacks highlights vulnerabilities in telecom authentication processes and underscores the need for stronger regulatory measures to protect customers. SIM swap fraud is increasingly plaguing the telecommunications industry and its customers. It was recently ranked second, behind synthetic identity fraud, among the most damaging fraud schemes affecting the telecom industry. 1. What is SIM swap fraud? SIM swap fraud is a cybercrime in which criminals gain control of a victim’s mobile phone number by fraudulently obtaining a replacement SIM card. Criminals may first collect personal information through phishing, social engineering, data leaks, or malware, and then use that information to impersonate the legitimate customer. Once the victim’s mobile number is transferred to the criminal’s SIM card, SMS messages including banking OTPs and transaction alerts can be received by the fraudster. SIM swapping requires no advanced technical expertise. Instead, it relies on the fraudster’s ability to manipulate telecom carrier employees into transferring a victim’s phone number to a SIM card under the fraudster’s control. Using basic personal information obtained from public sources or data leaks, fraudsters can carry out attacks with little more than a phone call or a visit to a retail store, without requiring coding or hacking skills. The only tools needed may be inexpensive prepaid SIM cards or burner phones. In a SIM swap attack, the attacker takes control of a legitimate subscriber’s mobile phone number by persuading the mobile telecom provider to link that number to a SIM card controlled by the attacker. SIM swapping is a legitimate procedure that serves a number of purposes, such as replacing a lost or damaged SIM card. It is also used to connect mobile phones to embedded SIMs (eSIMs), which are becoming increasingly common. In a fraudulent SIM swap, however, the attacker uses social engineering techniques to convince the telecom provider to transfer the number, impersonating the legitimate customer and claiming, for example, that the original SIM card has been lost or damaged. When the attack is successful, the legitimate subscriber’s phone loses its connection to the mobile network, preventing them from making or receiving phone calls. 2. 80% of SIM Swap Fraud Attempts Succeed Due to Weak Authentication A study by Princeton University found that 80% of first attempts at SIM swap fraud were successful. One of the main reasons for this high success rate is the use of weak authentication methods by telecom operators, which can be easily bypassed by fraudsters. While each carrier has its own vulnerabilities in the SIM replacement process, none required direct identity verification or implemented strong multi-factor authentication, allowing fraudsters to carry out remote attacks with relative ease. Telecom operators have often prioritized convenience over security, opting for simpler authentication methods to streamline customer service. In doing so, they may inadvertently create opportunities for fraudsters to exploit vulnerabilities. Lowering security standards to reduce friction for customers can ultimately weaken carriers’ defenses against SIM swap fraud. The risks become even more serious when mobile banking applications rely heavily on phone numbers and SMS-based OTPs for identity verification. If a newly registered device can be activated primarily using customer credentials and an OTP, a successful SIM swap attack may give an attacker access to the victim’s bank account. Weak device-binding mechanisms, insecure account recovery processes, inadequate session controls, and insufficient verification when registering a new device can further increase this risk. 3. SIM Swap Fraud Is Not Just a Consumer Problem SIM swap attacks are often viewed primarily as a threat to individual consumers, but they can have direct consequences for organizations as well. When an employee’s phone number is compromised, attackers can intercept one-time passwords (OTPs) sent via SMS and potentially gain access to corporate systems. This puts not only personal accounts at risk but also sensitive corporate data, financial assets, and customer records. One of the most significant concerns is account compromise through SMS-based authentication. Many organizations still rely on mobile phone numbers for password resets or two-factor authentication. If an attacker gains control of an employee’s phone number, they may be able to change login credentials for email accounts, cloud services, or financial systems often without raising suspicion until it is too late. The legal and reputational risks can be equally serious. Under the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018, organizations have obligations to protect personal and customer data. If attackers exploit weak authentication through a SIM swap attack, regulators may consider the incident in the context of data protection requirements. Beyond regulatory compliance, such incidents can also seriously undermine customer trust. 4. Measures to Prevent SIM Swap Fraud For these reasons, security experts recommend that organizations and telecom operators move away from SMS-based authentication and adopt stronger identity authentication methods, such as Identity and Access Management (IAM), authenticator applications, or hardware security keys. Banks can mitigate SIM swap fraud through measures such as strong device binding, risk-based authentication, transaction-level verification, controls over new-device registration, cooling-off periods for high-risk activities, real-time alerts, and server-side authentication and authorization controls. Customers, meanwhile, should avoid sharing OTPs, PINs, or login credentials and should never install banking-related APK files from untrusted or unknown sources. Ultimately, SIM swap fraud demonstrates why mobile banking security cannot rely on a single authentication factor. Instead, phone numbers, devices, customer identity, authentication processes, and transaction behavior should be treated as independent layers of security. SIM swap attacks clearly demonstrate why organizations need protective measures that go beyond the security standards typically applied to individual consumers. 5. Building Digital Trust Beyond SMS-Based Authentication SIM swap fraud highlights a broader challenge: digital security cannot depend on a single authentication factor – especially one tied to a mobile phone number. As digital services become increasingly interconnected, organizations need a more comprehensive approach that can establish trust across the entire digital journey—from identity verification and authentication to device security, transaction protection,
From Open Banking to Banking-as-a-Service: What Comes Next?
Over the past decade, financial innovation has evolved from open banking, which focuses on consumer-authorized data sharing, to banking-as-a-service (BaaS), which uses application programming interfaces (APIs) to make core banking functions more modular and accessible. Open banking & Open Finance The term “Open Banking” emerged around 2016 as a policy initiative aimed at increasing competition in the retail payments sector. The United Kingdom was the first country to explore this approach as a regulatory tool for promoting greater competition in digital payments through the Open Banking Implementation Entity. The idea behind these initiatives was straightforward: by making it easier for third-party providers (TPPs) to access data, regulators could lower barriers to entry, encourage competition, and create more opportunities for innovation in digital payments. A similar approach was taken by the European Union through the Second Payment Services Directive (PSD2), which came into effect in 2018. PSD2 required banks to provide registered third-party providers with access to customer account data through standardized application programming interfaces (APIs). Open Finance takes this concept a step further. While Open Banking mainly focuses on banking and payment data, Open Finance covers a much broader range of financial products and services, including credit, investments, pensions, and insurance. Under an Open Finance model, consumers can give third parties access to a broader set of financial data, potentially providing a more complete picture of their financial lives. While the potential benefits of Open Finance have not yet been fully demonstrated in practice and evidence of its impact remains limited, the concept could give consumers and businesses greater control over their financial data. By making more financial data available, Open Finance could help reduce information gaps, encourage competition, and create opportunities for more personalized financial products. These products could better reflect an individual’s financial profile, spending habits, and long-term goals. Open Finance can also make it easier for consumers to bring together and compare information from multiple providers, helping reduce complexity and make financial decisions easier. Concept of Everything-as-a-Service (XaaS) Against this backdrop, Open Banking is often seen as one of the starting points for the rise of Banking-as-a-Service (BaaS) – a new approach to financial services that brings data-driven capabilities into the way banking services are delivered. BaaS is built around the broader concept of Everything-as-a-Service (XaaS), also known as Anything-as-a-Service. XaaS refers to a wide range of cloud-based and remotely delivered services that companies can access through the Web or similar networks. The idea started with Software-as-a-Service (SaaS), where cloud providers made individual software applications available to customers. Over time, the model expanded into other services such as Infrastructure-as-a-Service (IaaS) and Communications-as-a-Service (CaaS). Eventually, the concept developed into the broader XaaS model, where businesses can access the specific services they need and pay for them on demand. In simple terms, instead of buying a software license and installing the application on individual computers, a business can subscribe to a cloud-hosted application provided by the software company. This approach gives businesses greater flexibility to switch providers while also making software maintenance easier. APIs play a key role in making this possible. They allow different applications and software systems to communicate and work with each other. As XaaS continues to grow, opportunities are also expanding for developers to build third-party applications that connect with existing platforms. The growth of SaaS, for example, has created entire businesses around developers and companies using SaaS platforms. However, APIs and SaaS are not the same thing. APIs do not require SaaS, and they have existed long before the Internet. They can also be used in offline environments. LinkedIn is an example of the SaaS model because it delivers its platform through cloud computing and generates revenue through recurring subscription fees. Facebook, on the other hand, does not operate as a SaaS company. Although it provides data through APIs, its primary source of revenue is advertising, much like Google’s core business model. Unlike SaaS providers, these platforms do not rely on subscription fees for their core services. Bank as a Service What banks can now build with APIs follows a similar XaaS approach. Banking-as-a-Service enables banks to deliver digital banking capabilities through APIs. In other words, banking services can move beyond traditional branches and become part of mobile and web-based experiences. Banks can make their data, functions, and infrastructure available through APIs, allowing other digital platforms and businesses to integrate banking capabilities into their own services. From the customer’s perspective, this can lead to very different types of digital experiences. A bank may continue to interact directly with customers, or it may operate behind the scenes as a white-label service provider. In either case, customers no longer have to interact with their bank in the traditional way. Instead, APIs allow consumers to interact with companies that may not be banks themselves, while still being seamlessly connected to regulated financial institutions through digital interfaces. While Open Banking has opened the door to greater data sharing, its role as a data-sharing mechanism can still have limitations. BaaS, meanwhile, can act as a catalyst for creating more seamless and integrated financial services in the digital economy. This model allows banks to move toward more customer-centric, platform-based business models. For traditional banks, this may also mean rethinking and restructuring how they operate. In many ways, the future of financial institutions could increasingly resemble the broader XaaS model. Making this transition possible requires a connected and collaborative ecosystem, where integration is at the core and APIs become a key enabler. Savyint provides a comprehensive Open Banking and BaaS ecosystem, backed by more than 20 years of experience in the Banking and Financial Services sector, with successful deployments for leading banks and major organizations across Vietnam and Southeast Asia (SEA). Contact us to start your banking digital transformation journey today HERE! Source: From open banking to banking-as-a-service – Nydia Remolin
Global Financial Fraud in Recent Years: Alarming Figures
Financial fraud targeting financial activities is becoming increasingly complex and sophisticated. The use of artificial intelligence (AI) by criminals, together with the widespread standardization and replication of malware and other technologies, is acting as a major driver of fraudulent activities. Financial Fraud Is Increasing Globally In INTERPOL’s March 2026 Global Financial Fraud Threat Assessment, financial fraud ranks among the top five global crime threats, with a 54% rise in fraud-related Notices and Diffusions from 2024 to 2025. Global fraud losses climb to $442 billion. The number of INTERPOL Notices and Diffusions related to fraud increased by 54% between 2024 and 2025. The sharp increase in INTERPOL alerts reflects the growing complexity and scale of cross-border fraud. Payment fraud is increasingly taking place across multiple jurisdictions, making purely domestic control measures no longer sufficient. Payment card fraud losses worldwide dipped 1.2% to $33.41 billion in 2024, according to the Nilson Report, the leading trade publication covering the global payment card industry. This fraud was tied to global card volume of $51.920 trillion. The 2026 AFP Payments Fraud and Control Survey Report provides that payments fraud remains widespread, with 76% of organizations reporting that they experienced attempted or actual fraud in 2025. Checks remain the payment method most frequently impacted by fraud. In 2025, 58% of organizations reported check fraud, outpacing ACH fraud and wire fraud. Despite long-standing awareness of check-related risks, checks continue to present persistent vulnerabilities for many organizations managing payments fraud risk. Business Email Compromise (BEC) remains one of the most common forms of payment fraud, as criminals increasingly exploit impersonation techniques to manipulate organizational processes. A 2025 study by global technology research and consulting firm Juniper Research found that e-commerce fraud is expected to increase from $56 billion in 2025 to $131 billion by 2030, representing a 133% increase over the period. This growth is driven by the rising incidence of friendly fraud, in which legitimate transactions are fraudulently disputed. Key Financial Fraud Trends AI-powered deception AI-powered manipulation is rapidly changing people’s perception of what can be considered trustworthy. Advanced AI tools can generate “deepfakes” — including realistic voices, synthetic videos, and highly personalized text — making it easier to stage scenarios that appear completely authentic, even to generations highly familiar with digital environments. As technology advances and the digital world becomes increasingly visual, victims find it more difficult to question what they see or hear. The boundary between reality and fabrication is becoming increasingly blurred. This creates an increasingly complex and unpredictable fraud landscape. According to Koren, once again, understanding human behavior has become critically important. Fraud Is Becoming More Personalized and Persistent Between 2024 and 2025, the number of fraud incidents involving social engineering increased by 33%. This method is not only growing in scale but is also undergoing a fundamental shift in its approach. To address future forms of fraud, technological expertise alone is no longer sufficient; understanding human behavior is equally essential. One clear trend is that social engineering is no longer simply a technical attack, but has evolved into a prolonged process of influencing individuals. Whereas fraud previously often consisted of a single message, we are now seeing multi-step schemes in which trust is gradually built over days or even weeks. Criminals are increasingly using psychological tactics: they spend time learning about their victims, mimicking their language and behavior, and then gradually influencing them to make decisions that ultimately harm themselves. The Professionalization of Fraud Tools One clear emerging trend is the professionalization of fraudulent online storefronts. Scam websites have evolved significantly: they are no longer crude and poorly designed sites, but professionally built platforms with convincing e-commerce interfaces and close integration with digital marketing channels such as Facebook. Fraudsters can quickly create new stores with a trustworthy appearance within just a few hours, while flexibly adapting their visuals and messaging with remarkable sophistication. One alarming trend that Recorded Future called out is the increasing industrialization of support services and technology that allows fraudsters to maximize their effectiveness. One such popular tool allows scam operators to rewrite the code on an online retailer’s payments page and then steal, or “skim,” payment information as transactions happen in attacks called Magecart. The report points out that there were 10,500 such hacks active in 2025, leading to the compromise of over 23 million online transactions. These highly professional fraudulent commercial environments play a critical role in the constantly evolving fraud economy, targeting online shoppers through highly convincing storefront interfaces. Cross-Border and Distributed Fraud Operations We are also seeing a significant increase in cross-border fraud activities, particularly in the movement of illicit funds. Transactions are distributed across multiple countries, with participants — including both willing participants and individuals who are manipulated or unaware of the scheme — being used to break transaction flows into smaller segments, making them more difficult to trace. The recruitment of “money mules” often relies on psychological tactics involving financial pressure, social influence, and emotional manipulation. The “fraud economy” is becoming increasingly professionalized and global, while also becoming far more adaptable and resilient. Savyint Fraud Detection and Prevention Solutions With more than 20 years of experience in cybersecurity, information security, and cyber safety, particularly in the financial and banking sectors, Savyint has developed a comprehensive ecosystem of solutions for fraud detection, payment security, identity, authentication, and system access control. We leverage AI, AI agents, and the latest security standards to detect and respond to fraud, ensuring that every transaction conducted in our customers’ digital environments is protected in real time and capable of withstanding evolving and increasingly sophisticated forms of fraud over the long term. Our solution ecosystem includes: Contact us today for expert consultation HERE! Reference: https://www.helpnetsecurity.com/2026/03/18/online-fraud-victims-losses-interpol-report https://www.tietoevry.com/en/blog/2026/04/five-payment-fraud-trends-to-monitor https://www.mastercard.com/global/en/news-and-trends/stories/2026/recorded-future-annual-payment-fraud-report.html https://www.financialprofessionals.org/training-resources/resources/survey-research-economic-data/details/payments-fraud The Nilson Report
Ensuring Information Security in Electronic Transactions in Selected Countries
In the era of digital transformation, electronic transactions are becoming increasingly prevalent and have become an important foundation for commercial activities, public services, and social governance. Therefore, many countries have enacted legal regulations to protect parties involved in electronic transactions and ensure information security. 1. European Union 2. United States 3. Canada 4. Australia 5. Vietnam The laws governing electronic transactions in many countries, particularly developed economies, have become relatively comprehensive, covering legal frameworks, electronic signature/trust service regulations, personal data protection, enforcement of violations, international recognition, and clear technical standards. However, challenges remain regarding data security, personal data protection, and legal compliance, which need to be further strengthened and more rigorously developed. Reference:
Open Banking: APIs, Data, and User Consent
Open Banking is the development of a new financial ecosystem based on connections between financial institutions and businesses, supported by APIs. Financial institutions are enabling third parties to integrate services, provide access to banking data, and deliver entire banking services through APIs. So how can APIs, data, and user consent be managed and protected? Key Characteristics of Open Banking Open Banking focuses on serving consumers, with API or SDK technology as its core foundation and operates within the financial ecosystem. Open Banking has three key characteristics: data portability, customer autonomy, and recipient accountability. The International Organization for Standardization (ISO) defines data portability as “the ability to easily transfer data from one system to another without having to re-enter the data.” Based on this definition, in Open Banking, consumers can share their relevant banking data with third-party providers (TPPs), in line with “data portability.” Data portability in Open Banking is supported by standardized and interoperable data technologies, primarily APIs. This is a fundamental principle of liberal democracy, in which marketers are permitted to influence customers but must respect their autonomy. Open Banking empowers customers to control the sharing of their banking data, and this right is supported by customers’ legal rights to share data through Open Banking. Open Banking requires recipients of customers’ banking data (TPPs) to be accountable to customers. Therefore, Fintech companies receiving banking data must be responsible for protecting this data from leakage, theft,… This is why strict management of TPPs through a regulatory system is very important. In summary, these three characteristics of Open Banking all reflect the goal of improving competitiveness, promoting innovation, and strengthening consumer protection. Solutions for Managing APIs, Data, and User Consent With many years of experience in developing security solutions as well as specialized solutions for the Financial – Banking sector, Savyint has developed an Open Banking Tech Stack solution that enables banks to comply with the current legal regulations of each country (such as EU PSD2/3, Philippines AFASA, BSP Circular No. 1213 – 1215, Vietnam Circular No. 64, Circular No. 50, Circular No. 77…), ensuring end-to-end security across API protection, payment, data sharing, and consent management operations. In particular, the solution is flexibly designed by Savyint according to scale, prioritizing the use of existing security infrastructure: small banks can deploy it in a simple and lightweight manner; large banks can scale up to a highly redundant model, ensuring continuous and stable operations even in the event of incidents. Contact us now for consultation HERE!
SAVYINT Develops Open Banking Tech Stack – Enabling Secure, Flexible, and Compliant Open Banking Connectivity
Savyint Open Banking Tech Stack enables banks to build and operate an Open Banking ecosystem on a unified architecture, covering TPP management, API management and delivery, consent management, data sharing, and payment initiation. Open Banking is becoming a key pillar of digital transformation strategies across Vietnam’s banking and financial services sector. Through open API, banks can connect with Third-Party Provider (TPP), FinTech, and digital platforms to provide services such as account information access, financial data sharing, and payment initiation. In this context, API serves as the key bridge connecting banks with the broader ecosystem. However, API connectivity also means that banks must extend their security controls beyond internal systems to encompass multiple partners, applications, and users. Every API transaction must be authenticated, access-controlled, and protected to ensure data integrity. At the same time, regulations governing open API deployment, cybersecurity, data protection, and related requirements have been introduced across many countries, including Singapore and Vietnam (Circular No. 64, Circular No. 50, Circular No. 77…), as well as the Philippines (AFASA and BSP Circular Nos. 1213–1215) … Compliance with these requirements has become a critical priority for banks. Banks must not only secure APIs but also protect cryptographic key, authentication information, signature, and evidence associated with data exchange and transaction processing. They must also maintain activity logs, detect anomalous access, and ensure that all operations are traceable for auditing purposes. Therefore, one of the key challenges facing banks today is how to leverage existing infrastructure while integrating the missing capabilities into a unified, comprehensive, scalable Open Banking architecture that can strictly comply with applicable regulations. SAVYINT’s Implementation Solution With extensive expertise in Open Banking, Open Finance, and payment security, Savyint provides a comprehensive HSM-powered Open Banking Tech Stack that enables banks to comply with applicable regulations while strengthening security across API protection, payment processing, data sharing and consent management. SAVYINT’s Open Banking Tech Stack is designed on a Microservices architecture, allowing banks to deploy capabilities in phases, leverage existing systems, and easily expand their Open Banking services in the future. With Savyint Open Banking Tech Stack, banks can build a centralized Open Banking ecosystem where data, consent, and transactions are managed end-to-end on a unified platform. This enables seamless connectivity with FinTech, ecosystem expansion, and the development of new digital financial services, while supporting full compliance with applicable regulations across markets governing open API, data security, and payment transactions.