Payment fraud often starts with a convincing conversation rather than a technical failure. A supposed seller, courier or support agent asks you to act quickly and moves you away from the normal application. This independent guide explains defensive decisions using Vietnamese provider and consumer sources checked on 23 October 2026. It cannot guarantee that a payment will be recovered.
Identify the action the stranger wants
Look beyond the story and name the requested action: disclose an OTP, enter a password on a new page, install an app, change a recovery number or send money. MoMo warns that impersonators copy its identity and ask for security information. A familiar logo, realistic transaction amount or knowledge of your name does not establish authority. Stop before performing the requested action and reach the organisation through a channel you opened yourself. The question is not whether the message looks polished, but whether the request belongs in the normal authenticated workflow.
Separate genuine verification from disclosure
A legitimate application may ask you to complete verification inside your own account. That differs from reading an OTP to a caller or pasting it into a page reached through an unexpected message. MoMo’s biometric requirement should not be used as a reason to trust someone offering remote account activation. Open the application independently and inspect your verification status there. If help is needed, use official support without granting control of the device. An urgent threat that funds will disappear unless a stranger receives a code is a reason to pause.
Treat QR codes as untrusted instructions
A payment QR may direct a bank application to a real account that belongs to the wrong person. Read the resolved beneficiary and amount. Ask a merchant to explain a mismatch rather than accepting that the account “belongs to an assistant.” A QR code that opens a website instead of a payment confirmation deserves a different assessment: check the address before entering any information. NAPAS’s beneficiary-checking feature supports this verification step, but it does not assess whether an invoice or seller is genuine. Your approval still matters.
Limit damage before an incident
Use a unique wallet password, a screen lock and the security settings available in the genuine application. Review linked-service limits and remove access you no longer need through official settings. MoMo recommends daily limits appropriate to the service rather than an unnecessarily high allowance. Keep the telephone number and recovery information current so you can report a problem. Save official support details independently of a search advertisement. A lower transaction limit is a containment measure, not evidence that the device or every incoming message is safe.
Respond in the right order
If a code or password was disclosed, stop interacting with the suspect and contact the provider from a trusted device or channel. Describe what was revealed and whether money moved. If a bank was linked, notify it as well when relevant. Preserve the conversation, payment reference and timeline without continuing the attacker’s instructions. Do not pay a supposed recovery agent who claims a second transfer is needed to release the first. Recovery depends on the actual incident and provider procedures; reporting promptly improves the information available but does not guarantee reimbursement.
Report without spreading sensitive data
Prepare a private evidence file with screenshots, dates, recipient details and official case references. Do not post full identity documents, account credentials or a live recovery link in a public warning. Explain to family members what the attacker asked you to do so they can recognise the pattern without repeating the malicious link. For a consumer dispute, use the Commission’s assistance route; for account compromise, use the financial provider’s security route promptly. These processes can coexist, but a public social-media complaint is not a substitute for either one.
Comparison and scope
| Signal | Safer interpretation | Immediate action |
|---|---|---|
| Caller requests OTP | Possible account takeover or payment approval | End the call; contact provider independently. |
| QR recipient differs | Address may be wrong or substituted | Do not approve until independently confirmed. |
| Refund requires a new transfer | Recovery story may be fraudulent | Ask the genuine provider to verify the case. |
| Unexpected verification link | Branding is not authentication | Open the official application yourself. |
Practical checklist
- Name the exact action being requested before doing it.
- Keep OTPs, passwords and recovery codes private.
- Verify beneficiary details in the bank or wallet confirmation screen.
- Set ordinary spending limits and review linked services.
- After exposure, contact the provider from a trusted channel promptly.
- Preserve evidence privately and reject paid recovery promises.
Frequently asked questions
Can a message with my correct name still be fraudulent?
Yes. Knowing some personal or transaction details does not prove the sender is your provider. Independently verify the request before acting.
Does biometric verification make every transfer safe?
No. It helps authenticate an account action but cannot guarantee that a recipient, invoice or request is legitimate.
Should I delete the conversation immediately?
Stop responding, but preserve evidence privately if safe to do so. The provider may need the timeline, message content and payment reference to investigate.
Sources and verification
- Recognising impersonation — MoMo — 2026-10-23
- MoMo biometric verification requirement — MoMo — 2026-10-23
- NAPAS fast transfer service — NAPAS — 2026-10-23
- Security of linked funding sources — MoMo — 2026-10-23
- MoMo complaints process — MoMo — 2026-10-23
- Consumer complaint handling process — Vietnam Competition Commission — 2026-10-23