Lừa đảo trực tuyến tại Việt Nam giảm mạnh, nhưng thủ đoạn AI ngày càng tinh vi

Online fraud in Vietnam 'shows clear signs of decline'

The number of online fraud cases in Vietnam has decreased by 56% compared to the first half of last year, yet tactics remain sophisticated due to the use of AI and the exploitation of personal data.

This information was shared at a conference on disseminating the Law on Cybersecurity and the Law on Personal Data Protection on August 21. According to Lieutenant Colonel Le Anh Tuan, Deputy Head of Division 5, Department of Cybersecurity and High-Tech Crime Prevention (A05), the online fraud situation in the first six months of 2026 "shows clear signs of decline."

Specifically, Vietnam recorded 959 online fraud cases, a 56% decrease compared to the same period in 2025. Meanwhile, estimated losses were approximately 1.5 trillion VND, a decrease of about 38%.

Lieutenant Colonel Le Anh Tuan, Deputy Head of Division 5, Department of Cybersecurity and High-Tech Crime Prevention (A05), speaking at the conference on disseminating the Law on Cybersecurity and the Law on Personal Data Protection on August 21, 2026. Photo: Luu Quy

Explaining these results, Mr. Tuan stated that the synchronized intervention of regulatory agencies, police forces, banks, telecommunications and technology enterprises, and digital platforms has contributed to curbing criminal activities.

For example, in the banking and payment intermediary sector, as of March 23, the system had detected over 688,000 records of suspicious accounts, e-wallets, and bank cards, while issuing warnings to 3.5 million customers. According to statistics, over 1.1 million customers stopped or canceled transactions in time, thereby protecting more than 3.99 trillion VND.

In the telecommunications sector, enterprises are required to continue reviewing and handling "junk" SIM cards and non-registered subscribers, while implementing solutions to warn against suspected fraudulent calls and filter spam and brand-impersonating messages.

Digital platforms, social networks, and e-commerce sites have also been urged to strengthen scanning and handling of fake accounts and content. Meanwhile, technology enterprises need to research solutions for Deepfake detection, identity verification, and fraud detection.

However, he noted that a decrease in the number of cases does not mean the risk has been completely controlled. Criminals are constantly changing their methods, with AI, image and voice synthesis technology, and personal data becoming key tools.

New challenges from AI

According to the representative of the Department of Cybersecurity, deepfakes and voice synthesis technology are making it harder to identify scammers. Criminal groups can create highly realistic fake images, videos, or voices to impersonate relatives, business leaders, or reputable individuals to request money transfers.

Another risk is that criminal organizations are researching and providing tools to bypass biometric authentication in online payments. This creates further challenges for banks and payment intermediaries as authentication methods are increasingly used to prevent fraud.

Besides AI, personal data continues to be one of the critical factors helping fraud rings reach victims. According to Mr. Tuan, criminals can purchase large amounts of data and categorize it by profession, residential area, income level, and lifestyle habits, combining information from banks, shopping, utilities, and many other sources. Obtaining this data helps scammers build scenarios tailored to each victim's situation, making them more likely to fall into the trap.

Sharing on the sidelines of the event, Mr. Pham Tung Duong, Security Director at FPT, also noted that personal data faces many risks when AI is deployed.

According to Mr. Duong, users may inadvertently input personal data into prompts; systems may collect more information than necessary; and personal data may persist in knowledge bases, memory, operation logs, or system caches. Additionally, risks can arise when AI is granted excessive access, connected to external systems, or uses third-party services. He believes that establishing data protection measures at only a single stage will leave significant gaps.

Beyond AI and data, A05 also warned that the trend of attacks on mobile devices is increasing. The nTrust anti-fraud system of the Vietnam National Cybersecurity Association recorded nearly 63,000 new types of mobile malware in Vietnam in 2025. Many fake applications are distributed to steal data or take control of devices. According to authorities, mobile phones are becoming attractive targets because users perform more financial and communication activities on them and are often less vigilant than when using computers.

Criminals also tend to operate under organized and cross-border models. Since the beginning of the year, local police have discovered several groups of foreigners entering Vietnam and renting locations to conduct fraud targeting foreign citizens. More than 219 foreigners have been arrested in connection with these activities.

Enterprises become the defense line

According to the A05 representative, the decrease in fraud cases shows that coordination between regulatory agencies and enterprises is effective. However, given the changing nature of crime, enterprises are identified as a crucial defense line.

Overview of the conference on disseminating the Law on Cybersecurity and the Law on Personal Data Protection on August 21, 2026. Photo: Luu Quy

According to Mr. Tuan, the goal for the coming time is not only to reduce the number of cases but also to shorten the time for detection, warning, and blocking of suspicious transactions. Regulatory agencies are also coordinating with the State Bank of Vietnam to perfect mechanisms for blocking, tracing, and handling cash flows related to illegal activities.

On the enterprise side, Mr. Pham Tung Duong from FPT proposed three risk checkpoints for data throughout the process of AI processing and using personal data.

The first checkpoint controls data before it enters the model, ensuring AI only accesses necessary information and that sensitive data is masked or replaced where appropriate. The second is to control before AI performs actions with external systems, including data classification, access limitation, requesting minimal information, and having human-approval mechanisms for high-risk actions. Finally, controlling data before it is returned to the user or other systems through data loss prevention, monitoring, and anomaly detection mechanisms.

The Law on Cybersecurity and the Law on Personal Data Protection were passed in 2025. The Law on Cybersecurity took effect on July 1, while the Law on Personal Data Protection took effect on January 1, focusing on protecting information systems, personal data, data subject rights, responsibilities of agencies and enterprises, and handling new risks such as cyberattacks, AI, and cross-border data.

The law stipulates prohibited acts, including illegal data processing, using others' data to violate the law, trading personal data, and misappropriating, intentionally disclosing, or losing data.

Data trading can be fined up to 10 times the revenue obtained from the violation. Violating regulations on cross-border data transfer can result in a fine of up to 5% of the total revenue of the previous year in Vietnam, while other violations can be fined up to 3 billion VND, in addition to the risk of criminal prosecution and compensation for damages.

Luu Quy