Digital Security | Techcombank

Techcombank protects digital users

System/Technology

Techcombank implements secured website, two-factor authentication app login, and other system security control to protect customer accounts.

Two-factor authentication: Password and device biometrics to log in and make transactions
Secure, encrypted pages: The “closed lock” icon on our online banking site and website means that information transmitted from customer computer to Techcombank’s systems are encrypted.
Digital transaction is secure: Transactions that users make through Techcombank Mobile app and Online Banking are secured with a transaction signing steps on user’s device. Techcombank Mobile also use 3rd solution of advance mobile security solution to detect & prevent access from unsecure (jailbreak, rooted) devices.
Network security: Techcombank’s banking systems have firewalls that prevent unauthorized access to the system
Techcombank technical solutions: are comply with cybersecurity law & regulation of authorities and cyber international standards: ISO 27001, PCI-DSS, etc. (if any)

Types of risk

These are not all the types of digital scam, we only focus on the significant scams that occurred with Techcombank customers. Information will be updated (if any)

Malware

Phishing scam

Granting accessibility permissions on Android devices

1

What is Malware?

- Malwares are programs, files or instructions of a malicious nature which may disrupt, harm, impede access to, or in any other way to steal user’ login credentials (for example: username, password, passcode, PIN).
- Malware includes, but not limited to malicious code, ransomware, cryptoware, virus, trojans, worms and logic or time bombs.
- Once user’s computer is infected, a cybercriminal will be able to conduct fraudulent money transfers from bank account.

2

How Malware spreads?

Malwares can do more than impacting/ seizing bank account login credentials. Malwares can be programmed to perform a variety of tasks including but not limited to:
- Keylogger - log all keys typed by users into the device
- Allow fraudster access to the device (not only bank accounts but also impacting other applications/ accounts)- Be aware and DO NOT click on any suspicious links/messages
- Create backdoor to the device to allow fraudsters' access to the device anytime later
- Download to user's device other malwares for other purposes (including the above & more)
- Mails, SMS with attachments/links that may appear to originate from trusted companies. Malware could be hidden in the attachments in emails/ message/ SMS and in the disguise of invoices or accounting documents.
- Fake webpage that looks like Online Banking's login page. It may prompt you to enter any of your log-in credentials or OTP from your security token.

3

How to avoid getting infected?

- Have an up-to-date anti-virus software on user’s computer or mobile device
- Be aware and DO NOT click on any suspicious links/messages
- Double check sender's information, ensure sender's authentication when receiving a message

1

What is a phishing scam?

Phishing is a form of social engineering used by cybercriminals via sending users Emails/SMS/Zalo message and other social platforms, that appears from a reputational source in order to convince users to install malicious software.

It asks users to provide sensitive information, which might includes: personal information, login credentials, credit card number, etc.

2

Common phishing scam?

Phishing scams are usually sent from scammers to users' device, via:
- Email phishing attack
- SMS
- Website (pop-up, linked website, etc.)
- Phone number
- Zalo messages
- Other social media platforms

3

How to avoid phishing scams?

Ensure the emails/SMS/Zalo message you received are authentic before acting on them:
- Do not download or open any attachments from emails you find suspicious, even if they came from someone you know
- Delete emails that come from unknown sources
- Do not respond to emails asking for confidential information, e.gyour financial or personal informationPhishers like to use scare tactics and may threaten to disable an account or delay services until you update certain information

Protect your computer with firewall, spam filters, anti-virus and anti-spyware software. Ensure you are getting the most up-to-date software and update them regularly.

1

Risks of granting accessibility permissions on Android devices

Accessibility permission is a function on mobile devices of Android operating system (used for Samsung, LG, Oppo, Xiaomi, Redmi, Realme...) to help users use their phones more conveniently, especially are people with physical limitations. When granting accessibility permissions for other software/applications, crooks can steal personal information stored on the phone, sensitive information, information for using applications on the phone, especially login and transaction information on financial and banking applications… for improper purposes that users have no control over. Even crooks can make money transfers from the user's account to the crook's account on the user's phone without the user's awareness.

2

How to mitigate these risks?

At Techcombank, the security and safety of customer accounts is always a top priority. With the desire to help customers using the Techcombank Mobile application on Android devices avoid risks when the device installs applications containing malware or can give permission to thieves to take control of the device and causing insecurity for customers' accounts at Techcombank, Techcombank launches a new feature on TCB Mobile latest version 2.1.14 to help customers identify these applications and display warnings to customers immediately when opening Techcombank Mobile.

General security tips for users

Protect yourself from unwanted scammers

DOs

DON'Ts

Always validate the information you receive (contact number, web links, names, etc.)
Always question uninvited approaches
Regularly check bank and credit card statements for any unusual transactions or withdrawals and notify the bank immediately
Protect your personal information, mobile phone and tablet devices
Promptly inform to the bank if having any awareness of suspected fraud, loss of mobile device/ security details; unusual/unauthorized transactions & activities of Techcombank Mobile App/Online Banking.
Only use Techcombank products and services which are introduced in Techcombank official channels as:

Website: www.techcombank.com

Fanpage: Techcombank Viet Nam (with √)

Telesales: Northern region: 024 3228 3588 & Southern region: 024 3269 3188

Official branches national-wide

Do not reveal: OTP generated on App/ Web or sent via SMS; register passcode/ smart OTP, log-in credentials; personal/ financial/ bank account number/ number of credit and debit card to strangers or suspicious websites/ collectors
Do not allow others to access mobile device and register their face ID/ fingerprint on the device.
Never conduct any activities of sell, rent, or lend your digital account/ Online Banking account/ current account to anyone
Never click on any link with Techcombank name and products from an unofficial source.
Do not install apps with suspicion/from unorthodox sources due to the impossibility of control information security

Digital Guarantees

In the unlikely event that users do suffer from online fraud/ loss of money, Techcombank guarantees a full refund of any money that has been fraudulently transferred out of user account via Techcombank ’s Internet and Mobile Banking service if the root cause is from Techcombank ’s system error, and:

Users totally protect their mobile/PC/ laptop devices, username + password, log-in credentials from fraud/ hack/ virus/malware activities

Users install the latest version of app/ OB and run with the latest personal information (National ID, mobile number, signatures, etc…)

Users have to update with Techcombank immediately when there is a change in their contact details (mobile number, email address, etc.) for the purposes of receiving SMS alerts or email notifications for online banking transactions and activities.

Users inform bank immediately if:

Users are aware of any suspected fraud, including any compromise or loss of their security device or security details; or
Users receive SMS or e-mail alerts for transactions which they did not perform; or
Users are alerted on change of daily withdrawal limit or add beneficiary for transfer to an account which they do not know of or did not perform, and they furnish Techcombank with all information requested by the bank.