Internet Banking Safety in Vietnam: OTP and Phishing

Internet banking safety comes down to one rule: you control where you log in, and you never share your one-time code. Most online bank fraud works by tricking you, not by breaking into the bank. If you remember two things from this guide, make them these. Type the bank's address yourself, and keep every code private.

How a fake bank site tricks you

The trick is called phishing. A criminal sends an email or text that looks like it comes from your bank. It says there is a problem with your account. It tells you to click a link and log in quickly. The link goes to a copy of the bank's login page. When you type your user name and password, the criminal receives them.

The message often creates pressure. It may say your account will be locked today, or that you have won a prize. It may use a bank logo and a polite tone. Do not trust it because it looks good. A copy is easy to make.

The web address is where fakes give themselves away. Criminals register names that look almost right, with a letter changed or added. They also put the real bank name at the front of a longer address that belongs to someone else. In an address such as example.com.scam.com, the site that matters is the last part before the first slash, scam.com.

Sources: Wikipedia, "Phishing" (revision of 9 February 2015).

Check the address and the padlock

Look at the address bar before you type anything. A bank login page should start with https, and your browser shows a padlock. Both are good signs. But they are not proof. A padlock means the connection to that site is encrypted. It does not tell you the site is honest. Criminals can also get a padlock for a fake site.

So use the padlock as one check, not the only one. Read the full address, letter by letter. Compare it with the address printed on your card, your statement or the bank's leaflet. If anything is different, close the page.

The safest habit is to avoid links in messages altogether. Type the bank's address into the browser yourself, or use a bookmark you saved on a day you knew the site was real. Then you never depend on a link someone else sent you.

Sources: Wikipedia, "Transport Layer Security" (revision of 12 February 2015); Wikipedia, "Phishing" (revision of 9 February 2015).

What an OTP is and why you never share it

OTP means one-time password. It is a code that works for a single login or a single transfer, and then it is useless. Banks that offer internet banking commonly use these codes to protect transfers. The code may arrive by SMS on your phone, or it may appear on a small token device that you hold.

The code only protects you while you are the only person who sees it. If a criminal has your password and also gets your OTP, he can move your money. That is why phishing pages often ask for the code too. The fake page passes your code to the criminal, who types it into the real bank at once.

This gives you a simple rule. A real bank does not ask you to read out or type your OTP for anyone else. A staff member who phones you, an email that asks for the code, or a page that asks for it for no clear reason is a scam. The code is for you to approve your own action, on the bank's own site, and nowhere else.

Read the SMS text before you use the code. Many banks write what the code is for, such as a transfer amount. If the message does not match what you are doing, do not enter it. Call the bank.

Sources: Wikipedia, "One-time password" (revision of 26 December 2014).

Habits that keep your account safe

Good habits take little time and stop most attacks. Use these every time you bank online.

First, use a strong password that you do not use anywhere else. A long mix of letters and numbers is better than a name or a birth date. If one website loses your password, the criminal will try it on your bank next.

Second, use a computer you trust. Avoid internet cafe machines and shared computers for banking. They may hold software that records every key you press. If you must use one, log out fully and change your password later from your own machine.

Third, keep your computer and phone up to date. Install security updates for your system and your browser. Run anti-virus software and let it update itself.

Fourth, always log out when you finish. Do not just close the window. Do not leave a banking page open while you check other sites.

Fifth, set up SMS alerts for transactions if your bank offers them. An alert for each transfer tells you within seconds if something is wrong.

Sixth, look at your statement often. Check small amounts as well as large ones. Thieves sometimes test an account with a tiny payment first.

Sources: Wikipedia, "Phishing" (revision of 9 February 2015); Wikipedia, "One-time password" (revision of 26 December 2014).

What to do if you think you were tricked

Act fast. Minutes matter. If you typed your password into a page you now doubt, change it at once, using the bank's real site that you typed yourself. If you shared a code, call your bank straight away. Use the phone number printed on your card or on the bank's own materials, not a number from the message.

Ask the bank to block the card or the internet banking access while it checks your account. Tell the bank which transfers you did not make, and when. Keep the message, the address of the fake page and any screenshots. These help the bank trace the fraud.

Do not feel embarrassed. These messages are built by professionals to fool careful people. Banks hear these reports every day, and the earlier you call, the better your chance of stopping a payment.

Finally, tell family and friends. Older relatives and first-time online banking users are the most common targets. A two-minute chat about the rules above can save someone a month of salary.

Sources: Wikipedia, "Phishing" (revision of 9 February 2015). General guidance, not legal or financial advice.

Sources

Wikipedia, "Phishing" (revision of 9 February 2015); Wikipedia, "One-time password" (revision of 26 December 2014); Wikipedia, "Transport Layer Security" (revision of 12 February 2015). Dated revisions at en.wikipedia.org. Bank-specific rules differ, so follow the written security advice your own bank gives you.