Warning Over Malicious “Digital Wedding Invitation” Phishing Scam

According to the Hanoi City Police, these phishing websites typically prompt users to re-login, surrendering their passwords, phone numbers, or one-time passwords (OTP) merely to view the wedding card. Some deceptive links lure victims into downloading malware-laden application packages and granting sensitive permissions—such as access to SMS messages, contacts, and accessibility services. Through these elevated privileges, malicious actors monitor screen activity, intercept OTP authentication codes, and execute fraudulent bank transfers.

Fabricating fraudulent websites and distributing malicious software to gain unauthorized access to computer networks, digital devices, and accounts to commit asset theft constitute criminal offenses under Article 289 and Article 290 of the Penal Code. Offenders face criminal liability with penalties reaching up to 20 years in prison, depending on the nature, severity, and consequences of the violation.

To guard against these threats, the police urge citizens to adhere strictly to the “Four Don’ts and One Always” principle:

First, do not rush into believing unsolicited notifications. Second, do not click on unverified links. Third, do not disclose sensitive security credentials. Fourth, do not transfer funds or grant device permissions without prior verification. Alongside these cautions, always double-check and verify information before taking action.

Citizens must remain vigilant against messages containing unknown links, uncharacteristic forms of address, mass blast dispatches, or persistent urgency to open URLs while systematically evading direct voice or video calls. Under no circumstances should individuals enter passwords, OTP codes, or banking credentials into third-party websites to view an invitation. Users must never install applications outside official app stores or grant accessibility services to unknown software. Citizens are advised to enable two-factor authentication across social media accounts and place a direct phone call to the sender for confirmation.

If individuals suspect their personal data or credentials have been compromised, they should immediately disconnect the device from the internet, contact their bank to lock accounts urgently, change credentials using a separate, secure device, and preserve relevant digital evidence to file a report with the nearest police station.