Philippines warned as Vietnam bank biometrics exposed fraud

Vietnam’s sweeping banking identity overhaul is emerging as a warning for the Philippines as local financial institutions face stricter anti-scam rules and a June 30, 2026, deadline to move away from SMS and email one-time passwords for high-risk transactions.

When the State Bank of Vietnam began enforcing biometric verification requirements in 2024, banks across the country ran a system-wide re-verification of account holders, according to Trusting Social.

The review found that nearly half of Vietnam’s registered bank accounts — more than 86 million of approximately 200 million accounts — could not be matched to a real person, Trusting Social said.

By September 2025, those accounts were shut down.

Trusting Social, a financial technology company founded in the United States in 2013 and now headquartered in Singapore, said its experience in Vietnam offers lessons for the Philippines, where banks, e-wallets and other financial institutions are preparing for tighter rules under the Anti-Financial Account Scamming Act, or AFASA.

“We spent years in Vietnam building systems that had to work for real people, on basic phones, in rural areas, with documents that weren’t always perfect,” said Nguyen Nguyen, Founder and CEO of Trusting Social. “That experience taught us what fails in production and what doesn’t. When the Philippines mandate came, we already knew what to watch out for.”

The Vietnamese mandate exposed not only weak data but also years of criminal abuse of banking systems that did not consistently require proof that account holders were real people.

The State Bank of Vietnam reported a 59 percent drop in individual fraud and theft cases and a 52 percent decline in accounts receiving illicit funds within months of enforcement, Trusting Social said.

Implementation, however, was uneven.

Trusting Social said only two banks had achieved a biometric registration rate above 20 percent two weeks into the rollout.

In May 2025, Vietnamese police dismantled a 14-member gang that allegedly laundered USD 39 million over seven months using AI-generated fake facial scans to bypass biometric checks, according to Trusting Social.

The company said the case showed that biometric rules can raise the security floor, but banks using minimum-viable systems may still leave gaps that fraud networks can exploit.

Across Trusting Social’s deployments, fraud prevention systems at eight leading Vietnamese banks blocked more than USD 4.3 billion in attempted mule transactions within a single year, the company said.

“Our experience in Vietnam showed us that when banks get stronger, fraudsters move to whoever is weakest,” Nguyen said. “The institutions that built properly protected their customers and ones that didn’t become the new target. That is the lesson we saw play out in Vietnam, and the one the Philippines needs to take seriously.”

The Philippines is facing similar pressure.

The Bangko Sentral ng Pilipinas received 70,000 fraud complaints in 2024, while the Cybercrime Investigation and Coordinating Center logged 10,004 cybercrime complaints in the same year, three times the 2023 figure, with losses reaching nearly PHP 198 million.

Trusting Social said many at-risk accounts in the Philippines were opened offline, with no identity verification against a living person.

BSP Circular No. 1213 requires covered financial institutions to limit authentication methods that can be shared with or intercepted by third parties, including OTPs sent through SMS and email, because of social engineering risks. The circular also cites biometric authentication, behavioral biometrics, passwordless authentication and adaptive authentication as stronger mechanisms for customer-initiated transactions.

Under AFASA, Republic Act No. 12010, the BSP’s implementing regulations seek to prevent, detect and delay fraudulent transactions, improve the tracing and recovery of disputed funds, and provide procedures for accessing and sharing financial account information for law enforcement purposes.

“Every institution we work with wants to get this right,” said Johnny Escaler, CEO of Trusting Social Philippines. “The challenge is not willingness, it’s perspective. The banks that got this right in Vietnam stopped looking at the requirements and focused on how to make sure the customers never have to think about fraud again, and that made all the difference. AFASA is giving our industry the same opportunity to make that choice.”

“There are Filipinos who stopped using digital banking after being scammed, there are more who never started,” Escaler added. “Every institution that builds this well is an institution that gives those people a reason to come back. That is the outcome worth working toward.”

Trusting Social said the June 30, 2026, deadline should not be treated as the finish line.

In Vietnam, regulators extended requirements in the 18 months after the initial mandate to corporate accounts, card issuance and e-wallets, the company said.

Banks that built stronger systems were able to absorb the expansions, while those that adopted minimum controls had to rebuild under pressure, according to Trusting Social.

In the Philippines, the BSP has also circulated a draft framework recognizing server-side biometric authentication as an acceptable control for high-risk transactions and critical account changes, subject to safeguards. The draft says adoption of such controls may be considered in assessing risk management adequacy and potential liability under AFASA.

The BSP draft defines server-side biometric authentication as a process in which a customer’s biometric credential is validated in the secure backend system of a BSP-supervised financial institution or its authorized third-party provider, rather than relying only on the customer’s device.

The draft also warns that centralized biometric systems can create cybersecurity, operational and privacy risks, including large-scale account takeover, irreversible exposure of sensitive identity data, spoofing, deepfake attacks and algorithmic bias if safeguards are weak.

“We have spent over a decade working on this problem,” Nguyen said. “The job is never done, Vietnam is proof of that. What the Philippines has that others didn’t is a head start: the data, the experience, the proof of what works. That only means something if the industry uses it well, together, for the people on the other end of every transaction.”

Trusting Social provides credit intelligence, digital identity verification and fraud prevention solutions to financial institutions across Asia.

The company operates in the Philippines, Vietnam, Indonesia and India, and works with more than 50 leading financial institutions and businesses in the Philippines, including major commercial banks, rural banks and digital lenders.