Cybersecurity risks in international payments, lessons from shocking incidents

In the digital age, international payments are increasingly becoming the mach of global trade and investment with the presence of SWIFT systems, international credit cards, cross-border e-wallets and fintech services.

However, Mr. Vu Ngoc Son - Head of the Research, Consulting, Technology Development and International Cooperation Department, National Cyber Security Association - warned that along with this explosion, the risk of cybersecurity and personal data violations in the international payment sector is also increasing.

The attacks not only caused financial losses of hundreds of millions, even billions of USD, but also undermined user trust and had a profound impact on global economic and financial security.

According to Mr. Son, hackers are increasingly using many sophisticated tricks such as fraud fraud via email and websites, installing malware to steal information, taking control of accounts and conducting cross-border transactions, or stealing personal data to sell on underground markets.

Service denial attacks have also paralyzed major payment systems such as Visa, Master card, and PayPal, disrupting global transactions and directly affecting the economy and user trust.

In fact, many typical cases have been recorded in recent years. The 2016 Bangladesh Central Bank case showed that the international payment system was not "untouchable" when hackers attacked SWIFT and forged a transfer order of nearly 1 billion USD, of which 81 million USD was successfully laundered through the Philippines casino system.

In 2017, an Equifax data breach exposed the personal information of 147 million Americans, forcing the company to spend more than $700 million in compensation and litigation, and costing CEO Richard Smith to resign.

A year later, British Airways' online payment system was attacked, exposing the credit card information of more than 500,000 customers, leading to a fine of nearly £229 million under GDPR regulations. In 2020, the SolarWinds case became a typical example of supply chain risk when malware was installed in the Orion software update, affecting more than 18,000 organizations, including many US government agencies and financial institutions.

Mr. Son said that the cause of these incidents comes from many factors. Technical loopholes are not patched in time, weak security management and complex dependence on third parties create conditions for hackers to exploit.

The differences in the legal framework between countries, along with the fact that many organizations, especially in developing countries, do not attach importance to investing in cyber security, further increases the risk.

From practical lessons, Mr. Son proposed a series of solutions. Financial institutions and businesses need to prioritize software updates and patching errors, applying multi-factor authentication, building an unusual transaction monitoring system using artificial intelligence, and periodically auditing and assessing the security of partners. Employees must be trained to raise awareness of cybersecurity. On the personal side, users need to be cautious when receiving strange emails or messages related to international payments, avoid using public Wi-Fi when making financial transactions and should prioritize the use of virtual cards or limited e-wallets to reduce risks.

At the macro level, building a strict legal framework on personal data protection such as the GDPR model, enhancing international cooperation in sharing cyber intelligence and establishing a cross-border emergency response mechanism when an incident occurs is urgent.

Mr. Son emphasized that the most important lesson is that no system can be absolutely safe. Only by synchronously combining advanced technology, strict security governance, human training, clear legal framework and international cooperation, can the world effectively protect personal data and ensure safety and sustainability for the global payment system.