A convincing-looking e-invite could cost you your bank balance. Police in Hanoi have issued a public warning about a phishing scam doing the rounds in Vietnam that arrives as a digital wedding invitation — a message many people open without a second thought.
The setup is simple and effective. Victims receive a link to a wedding card, but to view it they're asked to log in again, handing over passwords, phone numbers or one-time passcodes (OTPs). Other versions push a fake app download and ask for invasive permissions: SMS access, contacts and accessibility services. With those rights, criminals can watch your screen, intercept the OTP codes your bank sends, and drain accounts through fraudulent transfers.
This isn't a prank. Under Vietnam's Penal Code, building fake sites and spreading malware to steal assets falls under Articles 289 and 290, with sentences of up to 20 years for serious cases. Police are clearly taking it seriously — and so should anyone travelling in the country who relies on mobile banking.
Hanoi City Police recommend a rule of thumb they call the "Four Don'ts and One Always": don't trust unsolicited notifications, don't click unverified links, don't share security credentials, and don't transfer money or grant device permissions without checking first — but always verify the information before acting.
Red flags they highlight include mass-blasted messages, odd or uncharacteristic forms of address, heavy pressure to open a URL, and senders who dodge voice or video calls. The key advice: never type a password, OTP or banking detail into a third-party site just to see an invitation, never install apps outside official stores, and never grant accessibility permissions to software you don't know. Turn on two-factor authentication on your social accounts, and phone the sender directly if a message claims to come from a friend.
If you think you've been caught, act fast: disconnect the device from the internet, call your bank to lock the account, change your credentials from a separate, clean device, and keep any evidence so you can file a police report.
For travellers, the takeaway goes beyond wedding invites. Digital invitation links are a growing scam format across Asia, and visitors juggling unfamiliar SIM cards, banking apps and messaging platforms like Zalo are prime targets. The safest habit is boring but effective: treat any link that demands a login with suspicion, and verify through another channel before you type anything.
