Beware of fake digital wedding invitations on Facebook, Zalo: Risk of losing accounts, bank funds

4 days ago

4 min read

Wedding invitation messages from an acquaintance's account can still be a scam. Cybercriminals exploit digital wedding invitations to direct recipients to fake login pages or lure them into installing malicious applications, thereby stealing information and appropriating assets.

On October 17, 2026, the electronic information portal of the Hung Yen Provincial Police posted a warning from the Duc Hop Commune Police about the trick of impersonating others to send online wedding invitations. Scammers use fake accounts or compromised accounts to approach friends and relatives of the account owner, making the invitation appear credible.

From wedding invitations to information theft traps

The message often prompts the recipient to open the invitation, view wedding photos, or RSVP. Upon accessing the link, victims may encounter a fake page asking them to enter social media login credentials, phone numbers, passwords, or OTP codes. The Khanh Hoa Provincial Police also warned about this approach, recommending that users verify the sender through an independent communication channel.

There are two situations that need to be distinguished. With a fake login page, scammers seek to obtain information manually entered by the user. With a malicious application, perpetrators lure victims into downloading, installing, and granting sensitive access permissions. Therefore, it should not be stated that simply clicking on a wedding invitation link will immediately withdraw money; the subsequent actions and risks must be clarified.

According to the security guidelines of ACB, fake applications on Android may request Accessibility permissions. If approved, the malware can monitor activities, collect login credentials, passwords, PIN codes, OTPs, and be exploited to control transactions on the device.

Accessibility permissions originally serve the need to assist with phone usage. What requires vigilance is when an application from an unknown source requests this permission, especially when it is introduced just to view a wedding invitation.

Signs of suspicious digital wedding invitations

Recipients should stop interacting when encountering the following signs:

The invitation viewing page requests Facebook or Zalo passwords, OTP codes, or banking information.
The sender requests downloading an application, opening an installation file, or granting sensitive permissions to view the content.
The message continuously urges opening the link, while the sender avoids verification.
The form of address or invitation content is unusual; the link is of unknown origin.

A familiar name and avatar are not enough to confirm the sender's identity. The appropriate verification method is to call a previously known phone number or use an independent channel, rather than just asking back in the conversation that shows signs of being compromised.

What to do if you have opened the link, entered a password, or installed the application?

If you just opened the link: stop interacting, do not enter security information, and do not follow installation requests. Simply opening the page is not enough to conclude that the account has been compromised; it depends on what information the user has provided or what actions they have taken.
If you have entered a password: use a secure device to change the password, check, and log out of unfamiliar access sessions. This is the measure recommended by the Hung Yen Police for cases where login information has been provided.
If you have installed a suspicious application: stop financial transactions on that phone. Vietbank recommends locking digital banking services, disconnecting from the network, and checking and remediating the device before using it again. Another device should be used to contact the bank via official channels to request appropriate preventive measures if information leakage is suspected or if there are abnormal transactions.
If you have lost money or discovered a compromised account: save messages, links, screenshots, and transaction receipts to report to the police. Remediation must be done early; do not continue using the suspected malware-infected device to change banking information.

Proactively protect accounts and devices

Users should verify invitations before interacting, not provide security information to view the invitation, and avoid installing applications from links sent via messages.

ACB advises against installing applications outside the official Play store, recommends reviewing applications granted Accessibility permissions, and revoking those permissions when necessary. Vietbank also recommends using official download sources, enabling transaction notifications, and immediately reporting to the bank upon detecting abnormal activities.

How can fraudulent behavior be penalized?

Theo Bộ luật Hình sự được hợp nhất tại Văn bản số 135/VBHN-VPQH ngày 5/9/2025, hành vi xâm nhập trái phép có thể được xem xét theo Điều 289, với mức tù cao nhất 12 năm. Điều 290 quy định về việc sử dụng mạng máy tính, mạng viễn thông, phương tiện điện tử để chiếm đoạt tài sản, có mức tù cao nhất 20 năm.

Việc xác định tội danh và hình phạt phụ thuộc hành vi, điều kiện áp dụng, hậu quả và tình tiết của từng vụ việc. Không nên hiểu mọi trường hợp giả danh gửi thiệp cưới đều đồng thời bị xử lý theo cả hai điều luật hoặc đều chịu mức phạt cao nhất.

Proactively protect systems against cybersecurity risks with IPSIP Vietnam

Attacks via spoofed messages, phishing login pages, and malicious applications demonstrate that cybersecurity risks do not solely stem from technical vulnerabilities but can also originate from user actions. For businesses, system protection must be deployed across multiple layers, from controlling devices, emails, and network connections to monitoring signs of intrusion and assessing security vulnerabilities.

IPSIP Vietnam provides solutions tailored to the needs and resources of businesses, including FlexSecure 360 to enhance multi-layered protection, SOC 24/7 to support monitoring and responding to threats, along with PENTEST services to verify weaknesses that could be exploited. Combining appropriate measures helps businesses become more proactive in risk management and improves data protection capabilities.