MoMo, a Vietnamese e-wallet, warned on May 29 that platforms such as e-wallets and payment gateways may be exploited to spread even-odd and over-under gambling based on money transfer transaction codes1. The warning was given at a seminar on online risk run by the Vietnam Information Security Association (VNISA) the previous week, where MoMo information security head Pham Le Minh spoke on May 251.
A transaction ID (TID) is the string of digits that appears after each successful transfer and identifies that transaction1. Groups have built websites that predict the result of the transaction code, the report said. These services ask players to send money to a given wallet or phone number, with the transfer content stating a guess at whether the transaction code will be even or odd, over or under, or some set of numbers, promising to pay back several times the amount if the guess is correct1.
MoMo said it took several measures to stop the practice, but gambling websites kept changing their methods1. One measure added a "reference code", similar to the transaction code, before the transfer is made. "That way, instead of getting the code only after transferring, the user knows this code in advance, preventing it from being used to play even-odd games," Minh said1. Gambling sites responded by changing how the even-odd result is calculated, using the transaction code plus a segment of code generated by the website's own system as the comparison result1.
MoMo also built an API Abuse detection and prevention system to identify when its API is integrated into a service related to gambling, and limits the amount that suspected accounts can receive1. "When the groups change their methods and forms, our system automatically updates the rules, features and algorithms to detect them in time," Minh said1.
Ngo Minh Hieu, founder of the Anti-Fraud project, said hundreds of websites exploiting the e-wallet transaction code mechanism for gambling had been detected and blocked1. Because the rule is set by the website's own administrators, they can fully manipulate the result1. "Players are easily cheated because the result is manipulated, not to mention the risk of information leaks, since these websites have relatively loose security," Hieu said1.
After applying automatic detection, MoMo said it detected and blocked tens of thousands of accounts suspected of gambling activity1. MoMo representatives recommended that users not let others rent, borrow or illegally use their identity and identity documents, and to be wary of sophisticated online criminal tactics to protect their own assets1.
What it means for players
The scheme does not require a casino, an app or a betting account. A player only needs a local e-wallet and a phone number, which is why the warning covers payment gateways generally and not one operator1. Anyone sending money to a wallet or phone number with a guess written into the transfer content is exposed, and the outcome is decided by the site's own administrators, who can manipulate it1. The same sites are described as having relatively loose security, so personal information sent to them can leak1. Accounts flagged as suspected gambling can have their incoming limits restricted, and MoMo said it blocked tens of thousands of suspected accounts1. Vietnam's rules on gambling and the way local e-wallets handle transfers both bear on how these cases are treated; general background sits in the payments and scams and safety guides.
What happens next
No further dates were reported. MoMo said its detection system updates its rules, features and algorithms automatically as the groups change methods1.
Sources1 sources
- Mã giao dịch bị lợi dụng để đánh bạc online - Báo VnExpress, vnexpress.net
