Security and privacy are at issue as one-party state rolls out biometric technology

HO CHI MINH CITY — Those buying a laptop or paying rent now have to use facial recognition technology in Vietnam, where new payment rules are raising questions about privacy and security.

The Southeast Asian country began requiring biometric data on Monday for any digital transaction of 10 million dong ($390) or more made by bank or e-wallet transfer. To finalize transactions, customers would scan their faces via phone banking apps.

“It’s about convenience for the customer,” said Tung Vu, head of product at the VNG subsidiary Green Node, in an interview. The startup’s businesses include games, messaging and artificial intelligence, including providing facial recognition technology software to dozens of banks.

Vu said the convenience of virtual tech was demonstrated in the pandemic, when lockdowns prevented people from visiting bank branches for services like “know your customer” checks.

The State Bank of Vietnam said the regulation is meant “to ensure the safety and security in online payments and bankcard payments,” including for digital wallets.

But internet activists question the necessity of the mass collection of personal data, which creates vulnerability to hacks or leaks.

“Requiring biometric data for digital payments is a dangerous move for Vietnam, given the fact that it has been reported to be facing the most number of cyberattacks in Southeast Asia, followed only by Indonesia,” Golda Benjamin, Asia-Pacific campaigner at the digital civil rights group Access Now, told Nikkei Asia.

“The harms from the breach of biometric information is irreparable for users and the ecosystem.”

Vietnam’s web domain, .vn, was among the world’s five that were most liable to data-stealing malware in 2023, the cybersecurity firm Kaspersky said.

The one-party state has been digitizing citizens’ information, including identification data, as it builds a national database and moves more services online, from handling traffic tickets to collecting social insurance.

Residents are not allowed to opt out of the banking rules. In a country where phone lists are sold cheaply and tenants are registered with local police, privacy is not always a top priority. Vietnam ranked fourth to last among nations that did “the most to improve their citizens’ internet and data privacy,” the Stevens Institute of Technology said in 2023. Hanoi also requires tech companies to store user data domestically in case the government demands access.

The central bank, which issued the new regulation, said lenders must safeguard “customers’ data, ensuring compliance with the legal regulations on personal data protection.”

Private banks are still in the process of verifying account holders for the new system.

“With the increase in scams and fraud, improving customer security is a top priority for Timo,” Jonas Eichhorst, CEO of the digital bank Timo, said in a note to customers. “However, as banks adapt to this technology, it may initially impact [the] banking experience.”

Facial recognition technology has been used around the world for things like airline check-ins and Apple Pay, and is likely to spread in Vietnam. The prime minister signed a directive to promote tourism in February, telling the all-powerful Ministry of Public Security to research the technology as a tool to verify travelers.

The military-owned telecommunications company Viettel and the IT giant FPT are among the providers of the service.