- VnExpress reports that some short-drama reward apps show balances users could not withdraw, then push more ads and downloads. One user lost her phone data.
- Experts quoted say the balances are engagement tools, and software from unofficial sources can expose phones to code interception and keystroke recording.
- Leaders should check whether staff use personal phones for work approvals or login codes, and whether policy covers apps installed outside official stores.
A balance on a screen is only a number. In the short-drama reward apps described by VnExpress, that number is not a payment. It is what keeps a person watching, tapping and installing.
What users reported
In September, Anh Ngoc, 25, of Ho Chi Minh City, saw a Facebook advertisement for CoinDrama. The app credited her with VND250,000, about US$9.50, almost as soon as it launched. Then she learned that withdrawals required VND500,000.
To close the gap, the app told her to watch ads. The first added VND100,000 and the next VND50,000. The rewards kept shrinking until each ad added VND1,000. She spent a weekend afternoon on ads and still fell short. The app also pressed her to download other software and visit unfamiliar websites. She uninstalled it.
Hong Hanh, 28, of Lam Dong province, followed the steps of an app called MixReels. She downloaded several tools from websites she could not verify. One was a document reader that wanted broad permissions on her handset. Ads then appeared every 10 seconds, even with her internet connection disabled. She paid for a wipe and reinstall of the operating system and lost her personal data.
These are two accounts, not a measurement. VnExpress also reports Google Play download counts. CoinDrama has passed 10 million and CashDrama five million. Reel Drama and Bonus Drama each exceed 100,000. FreeFlick and Reel Reward are at roughly 50,000 installs apiece. Downloads are not victims, and the report does not say how many users lost money.
How the hook works
Dr. Le Duy Tan lectures at International University in Ho Chi Minh City and founded AIoT Lab VN. He describes the ad market this way: advertisers pay for impressions or engagement, and app developers are paid through ad networks. A single view earns little.
So the user's attention is the revenue. Tan said users "think they're making money by watching dramas, but they're actually generating advertising revenue for the app developers." He added that the balances shown on screen are often fictional figures designed to keep people engaged.
The report says some apps use virtual wallets, reward counters, lucky spins and progress bars. These create the impression that users are approaching a cash payout. Tan said such features are not necessarily fraudulent. They become suspicious when developers hide withdrawal conditions or keep adding new ones. Examples include more ads, inviting friends, completing tasks or paying a deposit.
The report notes that Google AdMob prohibits apps from paying people directly for watching or clicking ads. It does not say which ad networks these apps use.
What the install step involves
Nguyen Duc Hoai, CEO of Bizino, said not every video-reward platform contains malware. He said installing software from unofficial sources, especially Android APK files from untrusted websites, raises the risk significantly.
Depending on the permissions granted and weaknesses in the device, he said, malicious apps may read personal information and notifications. They may also intercept one-time verification codes or record keystrokes and screen interactions.
Hoai also cautioned that a small first payout does not prove an app is honest. Scammers may use one to build trust. Thai PBS reported that Bangkok police have warned of similar apps. Some allegedly withhold earnings, and others demand advance deposits.
The lesson for organisations
For an organisation, the install prompts matter more than the balance. That is our judgement. Neither Hoai nor the report ranks the two harms, and the only loss documented is one user's phone data.
The reasoning is simple. The on-screen balance works like casino chips: it feels like money inside the app and has no value outside it. The install step is different, because it can hand over access to the phone.
That matters beyond the individual. Hoai says a compromised phone may expose notifications and one-time codes. Those can include a bank alert or a work login code. The report describes personal harm only. The business question is whether any staff phone holds work access.
Questions for your team
Ask security and IT leads whether staff approve payments or log in to work systems from personal phones. Ask whether policy covers apps installed from outside official stores. Ask what staff are told about one-time codes.
Hoai offers three questions that fit a staff briefing: who is paying, where does the money come from, and what must I give up in return? An app that cannot answer the first two has not explained why it is paying anyone.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: VnExpress International.
