Biometric fraud technology threatens banking security systems

With the rapid development of technology for faking faces, voices, and even eye movements, authentication methods that once seemed impenetrable to cybercriminals are now ineffective.

AI technology is being exploited.

In the multi-billion dollar gambling ring recently busted in Thai Binh , the perpetrators used artificial intelligence (AI) technology to create fake facial videos, thereby bypassing biometric authentication on banking applications without the direct involvement of the account holder. This sophisticated tactic raises a worrying question: How can technology be abused to bypass seemingly impenetrable security barriers?

According to information from the Criminal Investigation Agency of Thai Binh Provincial Police, the unit has just initiated a criminal case and indicted 21 defendants related to gambling and money laundering. This is a shocking case as it marks the first time in Vietnam that criminals have used AI to facilitate illegal activities.

Besides organizing gambling, the suspects also laundered money by hiring people to open bank accounts in their names for players to deposit money. From Taiwan (China), they remotely controlled computers connected to phones with pre-installed banking applications in Vietnam. The money was then transferred through multiple accounts to conceal its illegal origin.

Specifically, to carry out large-value transactions of 10 million VND or more, which require biometric authentication, this group used AI-generated videos of fake account holders' faces, easily bypassing security systems without the cooperation of a real person.

A new scam has emerged that bypasses banks' biometric authentication.

Regarding the tactic of using AI technology to create fake facial videos to bypass biometric authentication on banking applications without the direct involvement of the account holder, Mr. Vu Ngoc Son, Head of the Technology Department of the National Cybersecurity Association, said that the case is being investigated by the authorities and official information will be released soon.

From a technical perspective, Mr. Son believes that the group most likely used a rooted Android phone, meaning they deeply interfered with the operating system to gain top-level access to the device. This is a privilege that manufacturers usually lock down to ensure data and system security. However, with some phone models, especially when in the hands of criminals, rooting is not too difficult.

After gaining control of the device, the perpetrators can install a virtual camera, a software program that mimics a real camera. Instead of recording images from a physical camera, the application receives signals from a pre-existing video clip, which may be created using AI technology. This method can trick banking apps into believing the account holder is undergoing biometric authentication, when in reality the image is fake.

What should users do to protect themselves?

According to Mr. Son, this is a prime example showing that the current fight against fraud is not just a technological race, but also a battle of wits between people. Therefore, in addition to strengthening technical solutions, it is crucial that users remain vigilant and alert. He also emphasized that not all banking applications are easily bypassed, as many institutions have added advanced layers of protection to prevent biometric spoofing. People should not panic excessively, but they should not be complacent either.

Speaking with a reporter from Tri Thuc va Cuoc Song newspaper , lawyer Nguyen Ngoc Hung - Head of Ket Noi Law Office ( Hanoi Bar Association) said that currently, perpetrators use many technological tricks to falsify biometrics, such as collecting facial images of victims from photos, videos, or leaked personal data online, then using deepfake technology to create a copy of the face. They use this copy to deceive the biometric authentication system of banks on the victim's device or a simulated device, and then steal assets.

Using fraudulent biometric technology to bypass banking app authentication systems and steal money is a high-tech fraud that can be prosecuted under Vietnamese law.

Accordingly, depending on the amount of money embezzled, mitigating and aggravating circumstances, and other factors affecting each individual and case, these individuals may face criminal penalties of up to 20 years imprisonment or life imprisonment for the crime of "Fraudulent appropriation of property" as stipulated in Article 174 of the Penal Code.

Banks have a clear obligation to establish and maintain sufficiently robust security systems to ensure the safety of customer accounts, especially when using biometric authentication technology. If the system is attacked or bypassed by fraudulent technology without timely detection or warning mechanisms, the bank may be held liable for related damages, such as compensation if it can be proven that the fault lay in the technical organization, internal control procedures, or inadequate warning to the customer.

Banks must also comply with legal regulations on cybersecurity, personal data protection, and the State Bank of Vietnam's regulations on providing electronic banking services. Failure to meet these requirements may result in administrative or even civil liability to the injured party.

To protect their legal rights and interests and avoid becoming victims of scams, citizens also have a responsibility to proactively protect their accounts, refraining from entering personal or biometric information into applications of unknown origin. They should not grant access to messages, screens, or settings from unknown sources.

Do not share clear fingerprint images, facial images, or videos on social media. Limit the use of fingerprint/facial recognition in public if you suspect someone is watching or recording you. Always verify carefully when someone asks you to open your banking app and scan your fingerprint or face. If you receive a request to update your banking app, verify it directly on the bank's official website. Do not confirm transactions unless the reason is clear; you can call the bank directly to verify these authentication requests.

When noticing signs of fraud, people should report it to the authorities and local police so that the perpetrators can be tracked down and the fraud can be stopped in time.

Lawyer Nguyen Ngoc Hung - Head of Ket Noi Law Office (Hanoi Bar Association).

Source: https://khoahocdoisong.vn/cong-nghe-gia-mao-sinh-trac-hoc-de-doa-he-thong-bao-mat-ngan-hang-post1546502.html