Among people who use Vietnamese banking apps, talk is going around that "from July 30 you won't be able to transfer with four digits." It started with notices VPBank and VietinBank issued to individual customers, grounded in Article 11 of State Bank (NHNN) Circular 50/2024/TT-NHNN. But what changes isn't the number of digits in the OTP that arrives by SMS; it's the PIN you enter yourself when starting Soft OTP / Smart OTP. The deadline also differs by bank, and VietinBank already made the switch on July 16. We check, against the original notices and the text, what expats with accounts in Hanoi or Ho Chi Minh City and business travelers who keep a shopping account in Vietnam need to fix and where.
How two banks' notices morphed into “transfers will stop”
It started with roundup articles CafeF ran on July 22, 2026 and Kenh14 on July 24. Aimed at VPBank NEO and VietinBank iPay Mobile users, they report that authentication codes will be at least six characters and valid for up to 12 months. Both are summaries of notices each bank gave its customers.
Trace it to the source and the notices split in two. VietinBank announced it would raise the Soft OTP PIN in iPay Mobile from four digits to six, effective July 16, 2026. VPBank announced that new Smart OTP rules for VPBank NEO individual customers would apply from July 30, 2026. That July 30 date is VPBank's; it's not a shared deadline for both banks, nor a date coming down on all Vietnamese banks at once.
These two got bundled into a single headline -- 'VietinBank and VPBank users' transfers change from July 30' -- and shrank further into 'four-digit OTPs will stop working.' What fell away in the shrinking was the crucial part: which code it's actually about.
What to fix isn't the number you receive, but the one you set yourself
In Vietnamese banking apps, authentication is split into three layers. The first is the login password or biometrics to open the app. The second isSoft OTP（Smart OTP）the PIN you enter to launch. The third is the one-time code shown on screen as a result of entering that PIN.
What's changing this time is the second thing, the PIN. VietnamNet, after clarifying that a Soft OTP activation code is distributed by the bank to the customer and used only to activate the device, treats the PIN and the generated OTP as separate things. In VietinBank's explanation too, Soft OTP is a mechanism that generates an authentication code on the device, and the PIN is positioned as the key that permits that generation.
Get this wrong and your response misses the mark. The number that arrives by SMS is issued by the bank; users can't choose its length. Search the settings all you like and no 'OTP length' item appears. What you should open is the Soft OTP or Smart OTP settings, and if your account only uses SMS authentication, this notice doesn't directly point at how you use it. That said, whether SMS authentication is enough depends on the bank and the type of transaction. Check your bank's official guidance for which method your account runs on.
The figures set by Circular 50/2024/TT-NHNN, Article 11
What all the banks' notices hang from in common is Circular 50/2024/TT-NHNN, issued by the State Bank on October 31, 2024 and effective January 1, 2025. It sets rules for the safety and confidentiality of online banking, and its scope reaches credit institutions, foreign bank branches, payment-intermediary service providers, and credit information companies. Article 11 lists the requirements for authentication methods, and that's where the PIN's length and validity period are written.
| Item | What Circular 50/2024/TT-NHNN sets out |
|---|---|
| The length of the mã PIN (PIN) | At least six characters (excluding the PIN attached to a physical card) |
| Length of the mã khóa bí mật (password) | At least 8 characters, including numbers, uppercase, and lowercase |
| Validity period | Up to 12 months |
| The code assigned as a default at first use | Up to 30 days |
| Date issued / date effective | October 31, 2024 / January 1, 2025 |
| Who it applies to | Credit institutions, foreign bank branches, payment intermediary service providers, and credit information companies |
The text says "at least six characters," not "six digits," and gives no upper limit. And the 12-month validity isn't a one-time thing. Even those who switched to six digits will be asked to renew again if they keep the same code for 12 months. The current fuss is the first wave of each bank's implementation, a year and a half after the rule took effect, finally reaching individual customers' screens.
Banks' explanations diverge: the reach of 'you can't transact'
Whether it stops or not shifts in tone with how the headline is written. But neither bank's published notice contains wording foretelling an account freeze. CafeF carries VPBank's explanation to the effect that the update work doesn't affect use of electronic banking. When VPBank announced the same PIN increase in 2025, it also wrote that what can't be executed until the update finishes is limited to "transactions requiring Smart OTP PIN authentication." The reach of the stoppage is only that far—not the account itself or all transactions. A notice in which either bank stated "all transactions will stop" isn't found within what's public.
VietnamNet reports that most banks have already made their adjustments regarding the move to raise the Soft OTP PIN from four digits to six. It's not just VietinBank and VPBank; it's closer to say these are the two whose notices stood out amid an industry-wide migration. An ninh Thủ đô and Znews also covered VietinBank's July 16 change for a general audience. Flip it around, and when your own bank switches over is something you can only check individually via each bank's official site and in-app notifications.
Where Japanese users trip up isn't the digit count but the re-activation
Coming up with a six-digit PIN itself takes a matter of seconds. Where things stall in practice is the identity check that comes before it.
Resetting a PIN or password, in Vietnam,Biometricsis more likely to be caught by X. State Bank Decision 2345/QĐ-NHNN has, since July 1, 2024, required face verification for transfers over 10 million dong per transaction (about 62,000 yen at 1 yen ≈ 162 dong, as of July 2026), transfers whose daily total exceeds 20 million dong (about 123,000 yen), a first transaction in the app, and transactions from a device different from the usual one. Reinstall the app on another device to change your Soft OTP PIN and you touch this net. We've covered stumbling over face-ID registration before (Your account freezes without face verification: a biometric checkup for Vietnam residents), and since foreigners don't hold a chip-embedded national ID, they're more likely to be routed to NFC reading of the passport or in-person verification at a counter.
A timing issue layers on top of this. Expats returning home for the summer sometimes spend time in Japan with their Vietnamese SIM suspended. Activation codes and confirmation SMS go to the Vietnamese number, so if you're asked to update while in Japan, you can't move until you revive the number. If you plan to be away from Vietnam for a while, it's less hassle to open your Soft OTP settings and change to six digits before you leave.
Corporate accounts are one notch more complicated. Authentication tied to the representative's biometrics is in place, and the pattern of transfers stalling when the deadline falls while the representative is abroad has happened before (Face ID for corporate transfers from July—the day Vietnam's company accounts stop when the representative is away). If you run accounting through a representative office or local entity, keep the PIN's 12-month expiry alongside the representative's travel schedule.
Another feature of this case is that even people who needn't hurry are hurrying. Vietnam's rule changes tend to circulate as "everyone is affected," while in reality cases that were limited keep piling up (“Health declaration for everyone” was a misunderstanding: in normal times, nothing is needed to enter Vietnam). This time too, what the notices name is individual customers using Soft OTP / Smart OTP; neither bank has issued any notice that something will happen to the account of a traveler moving small amounts with SMS authentication alone as of July 30.
What the disappearance of four-digit codes leaves for payment infrastructure
Payment-intermediary service providers are also within the scope of Circular 50. Not just banking apps but e-wallet authentication falls under the same text. In Vietnam, where wallets have worked their way into everything from street-stall payments to ride-sharing, retiring the four-digit PIN touches a broad swath of daily life. But each company's implementation timing is its own, and the dates aren't published side by side.
The 12-month rotation starts to bite from next year on. People who come to Vietnam only a few times a year will regularly find, on opening the app after a while, a renewal screen waiting. Notice it at the airport the day before your trip and you're stuck with no SMS arriving. From here on, the habit of opening the app once a week before departure pays off.
The system's aim is clear too. Four digits give 10,000 combinations and won't withstand brute force if the device is taken. Six digits raise that to a million, and a 12-month expiry cuts the lifespan of reuse. Layered with Decision 2345's biometrics, stealing the code alone won't push through a high-value transfer.
A list of what to check now
| Target | What changes | Deadline | Where to change it |
|---|---|---|---|
| VietinBank／iPay Mobile | The Soft OTP PIN goes from four digits to six | July 16, 2026 (already in effect) | “Cài đặt Soft OTP” (Soft OTP settings) in the app |
| VPBank / VPBank NEO (individual customers) | The Smart OTP code: at least six characters, renewed every 12 months | July 30, 2026 | From the app's notification to the renewal screen |
| Other banks | Each bank's Soft OTP / Smart OTP PIN | Per each bank's notice | The authentication settings in each bank's app / the notices section of the official site |
| Circular 50/2024/TT-NHNN | PIN at least 6 characters, valid up to 12 months, initial value up to 30 days | Effective January 1, 2025 | — (each bank rolling out in turn) |
| Decision 2345/QĐ-NHNN | Face authentication for transfers over 10 million dong at once or over 20 million dong cumulatively per day, a first transaction in the app, and transactions on a device different from the most recent one | In effect since July 1, 2024 | Biometric registration in each bank's app |
You can narrow the checks you can do yourself to three. See whether your banking app's authentication settings have a Soft OTP or Smart OTP item; if so, check whether the PIN is still four digits; and see whether your Vietnamese SIM can receive SMS. Since screen names and specific options differ by bank, if you get stuck, the fastest route is each bank's official guide or hotline.
Summary
The July 30 date concerns VPBank's Smart OTP; VietinBank's was done on July 16. What changes is the length and renewal cycle of the PIN you set yourself—not the number of digits in the code that arrives by SMS. If you're planning to be away from Vietnam for a while, open your app's authentication settings and switch to six digits before you go. Even those already on six digits should note the 12-month deadline in a planner to avoid being stuck at the same screen next year. When you're unsure, check your account's authentication method in the official site's "Thông báo" section or with a branch or hotline.
Sources:Kenh14／VietnamNet／CafeF／An ninh Thủ đô／Znews／DNSE／Full text of Thong tu 50/2024/TT-NHNN／LuatVietnam (Decision 2345/QĐ-NHNN)
