In September 2025, Vietnamese banks began deleting over 86 million bank accounts, a drastic measure triggered by new biometric verification requirements from the State Bank of Vietnam (SBV). Of roughly 200 million accounts on record, only 113 million personal and 711,000 organizational accounts survived the checks. The rest—nearly 43%—were dormant, duplicated, unverifiable, or opened by individuals who never intended to be traced.
How does a banking system accumulate 86 million accounts that no one can link to a real person? Gradually, as account opening procedures became easier over the years while verification of account control lagged. Identity records, transaction monitoring, and fraud alerts evolved in separate systems at different times, with weak connections between them. The cleanup required a national biometric identity program run with the Ministry of Public Security, something the industry's own controls never achieved.
Ironically, these 86 million accounts reflect the market's success. Non-cash transactions rose 40.74% year-on-year in early 2026, per SBV data. Several banks report that 95% of transactions now occur through digital channels, and VietQR acceptance has reached about 2.1 million merchant outlets. Vietnam built one of the world's busiest digital payments markets in under a decade, but the underlying infrastructure—identity checks, fraud monitoring, and system integration—has not kept pace.
Fraud Found the Gaps First
The National Cybersecurity Association estimates consumer losses to online fraud reached VND18.9 trillion (about US$744 million) in 2024. Police records show $1.5 billion lost across over 24,000 cases since 2020, with the trend worsening through 2025. Viettel Cyber Security logged 6.5 million compromised user accounts in the third quarter of 2025, a 64% increase from the previous quarter, plus nearly 4,000 phishing domains impersonating banks, government agencies, and online shops.
Very little of this fraud involved defeating a bank's security outright. A mule needs a dormant account, and until September there were tens of millions available. An impersonator needs a customer verified once, at onboarding, years ago. A suspicious transfer requires a monitoring system that cannot detect a device change or a new beneficiary added the day before, because that information sits elsewhere in the bank. The weak points lie between systems, not inside them.
Most Vietnamese banks run technology designed for a card-and-branch business, later augmented with instant transfers, QR codes, wallets, and e-commerce, one integration at a time. Each addition made sense individually, but together they create an estate where a new fraud rule takes weeks to deploy and covers only one channel, and where a significant portion of the technology budget goes to maintaining old connections rather than building new ones. There comes a point where patching stops being the cheap option, once the maintenance bill and losses from gaps are honestly totaled. Vietnam's transaction growth is pushing institutions toward that crossover faster than most markets.
Regulation has picked a direction. The SBV now mandates facial biometric checks for online transfers above VND10 million and for total daily transfers exceeding VND20 million. Its centralized fraud database, SIMO, connects 149 institutions; by mid-April 2026, it had pushed 3.7 million warnings to customers, and over 1.2 million of them paused or abandoned a transaction, keeping nearly VND4.17 trillion (about $158 million) out of criminal accounts.
Money is being directed too. Banks must commit at least 15% of technology implementation budgets to cybersecurity and data security, a floor set in the banking sector's 2026 digital transformation directive and reinforced by the new Cybersecurity Law. The Law on Data, the Personal Data Protection Law, and the Law on Digital Technology Industry, effective January 2026, put data handling and AI on a statutory footing for the first time. The expectation is clear: know who owns every account, share what you see, and be able to stop a payment while it can still be stopped.
Some banks have already jumped. VPBank, LPBank, and TPBank are among those investing heavily. VIB became the first in the country to run its core banking on AWS, alongside a private cloud. Payment rails are being rebuilt both outward and inward. Cross-border QR with China went live in December 2025, adding to existing links with Thailand, Cambodia, and Laos. The SBV announced a Vietnam–Singapore QR corridor in July 2026, NAPAS's sixth country connection, with Japan, South Korea, and Malaysia next. Merchants gain new customer bases with each corridor, but fraud, authentication, and settlement teams gain new jurisdictions, second currencies, and no extra seconds to work with.
The trap in all this investment is obvious: a bank can migrate to newer technology while keeping old fragmentation, with issuing, authentication, fraud monitoring, and servicing still in separate places. Building for the new Vietnam requires integrating these systems, not just layering on new features. The country's banking cleanup is only the beginning of a deeper transformation.
For more on Vietnam's evolving digital landscape, see our analysis of smart port cooperation with the US and the implications of graft cases on the security-state economy.
