Introduction
In electronic commerce contracts the parties often never meet in person, so when a dispute arises the first question is frequently not what the contract says but who actually signed it. A digital signature based on public key infrastructure allows cryptographic verification that the private key corresponding to a certificate was used and that the content has not been altered since signing. A digital signature, however, proves only that “the key was used”; it does not directly prove that “the subject signed of their own free will”. The gap between these two facts to be proved lies at the root of most disputes, particularly where the key-storage device is held by someone else or where signing is triggered remotely through a mobile phone.
Recent Vietnamese scholarship on electronic evidence in civil proceedings has observed that the Civil Procedure Code does not yet give digital signatures automatic evidentiary value, and has called for specialised digital forensic examination.1 This article approaches the problem at a different level: not how a court should verify a digital signature, but what procedural consequences follow once a signature has been verified as valid, namely the applicable presumption and the allocation of the burden of proof between the parties.
The current legal framework on the evidentiary value of digital signatures
The 2015 Civil Procedure Code recognised “electronic data” as a source of evidence for the first time in Article 94(1), and Article 95(3) provides that electronic data messages take the form of electronic data interchange, electronic documents, e-mail, telegrams, telex, fax and similar forms under the law on electronic transactions.2 Article 11(2) of the 2023 Law on Electronic Transactions adds that the evidentiary value of a data message is determined by the reliability of the manner in which it was generated, sent, received or stored, the manner in which its integrity was ensured and maintained, the manner in which its originator, sender or recipient was identified, and other relevant factors.3
Under Article 91(1) of the Civil Procedure Code, a party making a claim must prove that it is well-founded and lawful, and under Article 91(2) a party opposing another’s claim must likewise prove its opposition. Article 92 lists facts that need not be proved but contains no presumption concerning electronic evidence or digital signatures, and Article 108(2) merely requires the court to assess the lawfulness, relevance and probative value of each item of evidence.4 Meanwhile, Article 23(2) of the Law on Electronic Transactions gives digital signatures the same legal value as the signatory’s handwritten signature on a paper document, and Article 22(3)(d) makes the detectability of any alteration to a data message after signing one of the defining conditions of a digital signature.5
Consequently, neither statute regulates the procedural effect of a successfully verified digital signature: there is no rule that a validly signed data message is presumed to originate from the certificate holder, nor any rule on who bears the burden of proof when the holder denies it. “Legal equivalence to a handwritten signature” therefore remains a substantive recognition that has not yet been translated into a concrete rule of evidence.
Problems revealed by case law and foreign experience
A. Courts implicitly apply a presumption derived from standard-form contracts
Disputes over online banking transactions share the evidentiary structure of digital signature disputes: one party denies having performed the authentication step. In two cases decided on appeal by the People’s Court of Bac Ninh Province on 2 and 3 July 2024, the plaintiff was induced by fraudsters impersonating police officers to install malware, after which more than VND 26.5 billion was transferred out of accounts at two banks. The first-instance court found the banks “indirectly at fault” and ordered them to pay VND 700 million and VND 800 million respectively. The appellate court reversed, holding that the banks were not at fault, mainly because the user name, password and one-time password (OTP) were held only by the customer and the transactions had been performed in accordance with the authentication procedure; the court relied on the bank’s terms and conditions excluding liability for losses caused by the customer’s disclosure of authentication data.6
In substance, the appellate court applied a presumption: a transaction correctly authenticated is deemed to have been carried out by the account holder, or the account holder must bear its consequences. Yet this presumption had no statutory basis; it was derived from a standard-form contract drafted by the bank itself. The divergence between the first-instance and appellate outcomes reflects the absence of a uniform rule on the allocation of the burden of proof and of risk. Were the dispute to concern a digital signature on a commercial contract, the court would face exactly the same question: is a valid digital signature sufficient to presume that the certificate holder signed, and by what facts may that presumption be rebutted?
B. German and United States experience
In Germany, § 371a(1) of the Code of Civil Procedure (ZPO) applies the rules on the probative force of private documents to private electronic documents bearing a qualified electronic signature, and the resulting appearance of authenticity can be rebutted only by facts giving rise to serious doubt that the declaration was made by the person responsible for it.7 More significantly, in its judgment of 26 January 2016 (XI ZR 91/14), the Federal Court of Justice held that prima facie evidence (Anscheinsbeweis) that a customer authorised a payment may be applied only where it is established that the security procedure used was, in general, practically impossible to overcome and that it was properly applied and functioned without error in the individual case, and that the payment service provider must set out the security level of its system and, if this is disputed, prove it.8 In other words, the operator of the system may benefit from a favourable presumption only if it proves the reliability of that system itself.
In the United States, applying § 1633.9(a) of the California Civil Code, part of California’s enactment of the Uniform Electronic Transactions Act, the Court of Appeal in Ruiz v. Moss Bros. Auto Group (2014) held the evidence insufficient to attribute an electronic signature to an employee because the employer merely asserted that the employee had signed, without explaining how it ascertained that the signature was “the act of” the employee, for instance that it could only have been placed on the document by a person using the employee’s unique login ID and password;9 by contrast, in Espejo v. Southern California Permanente Medical Group (2016) an electronic signature was held to be authenticated where the proponent described in detail the security precautions governing the employee’s unique user name and password, the steps required to place his name on the signature line, and the recording of the date, time and IP address of signing.10 These cases point to one principle: the party relying on an electronic signature must prove the reliability of the signing process; once it has done so, the burden shifts to the party denying the signature. Both systems resolve the issue through statute or case law, not by leaving it to contractual terms.
C. No distinction between the two facts to be proved and no rebuttal grounds
Vietnamese law does not distinguish between proving that “the key was used” and proving that “the subject signed of their own free will”, nor does it specify the facts sufficient to rebut a presumption, such as revocation of the certificate notified before signing, misappropriation of the key-storage device, or a security vulnerability in a remote signing system. As a result, outcomes depend on how the court interprets the contractual terms in each case, and the weaker party, typically a consumer or a small business, bears risks allocated by whoever drafted the standard form, as the Bac Ninh appellate judgments illustrate.11
Recommendations
A. A rebuttable presumption for digital signatures
A new paragraph should be added to Article 11 of the Law on Electronic Transactions, together with a cross-reference in Article 92 of the Civil Procedure Code, along the following lines: “A data message signed with a digital signature or a secure electronic signature that is verified as valid at the time of signing in accordance with law shall be presumed to have been originated by the certificate holder, to express that person’s consent, and not to have been altered since the time of signing. This presumption may be rebutted if the denying party proves facts giving rise to serious doubt that the data message was signed by the will of the certificate holder, including: (a) the certificate had been revoked or suspended before the time of signing, or the certificate holder had notified the service provider of the compromise of the signature creation data before the time of signing; (b) the signature creation data or the authentication means used to activate signing had been misappropriated without fault on the part of the certificate holder; (c) the signature creation system or remote signing system suffered a failure or security vulnerability at the time of signing.” This provision draws on § 371a ZPO but specifies the rebuttal grounds to ensure predictability: the relying party need only prove that the signature is valid, while the denying party has clear grounds on which to rebut the presumption.
B. The burden of proof for other electronic signatures
For electronic signatures other than digital signatures, the law should provide: “Where a party denies an electronic signature that does not benefit from the presumption, the party relying on that signature shall prove the method and process by which the signature was created and the link between the authentication step and the signatory. Once this burden has been discharged, the denying party shall prove facts that undermine the reliability of the signature.” This rule reflects the principle developed in Ruiz and Espejo, is consistent with Article 91 of the Civil Procedure Code, and accords with Article 14.6(2)(b) of the CPTPP, under which no Party may adopt or maintain measures for electronic authentication that would prevent the parties to an electronic transaction from having the opportunity to establish before judicial or administrative authorities that their transaction complies with any legal requirements with respect to authentication.12
C. Conditioning the presumption on system security
The benefit of the presumption should be tied to a duty of system security. On the one hand, terms in standard-form contracts or general conditions that exclude all liability of a certification service provider, trust service provider, platform operator or credit institution for electronically authenticated transactions should be void where that party cannot prove that its authentication system met the statutory security standards at the time of the transaction. On the other hand, Decree No. 23/2025/ND-CP currently recognises remote signing only as one model of public digital signature certification service and, for that model, provides only that the service provider may hold the subscriber’s private key using secure storage methods;13 it should be supplemented with minimum standards for remote signing services: multi-factor authentication with at least one factor linked to the subscriber’s electronic identity or to anti-spoofing biometrics; display of the content, or a representative value, of the document before each signing operation; retention of signing-activation logs for at least the limitation period for contractual claims; and a mechanism for immediate certificate suspension through multiple channels. Compliance with these standards should be the condition for the operator to benefit from the presumption proposed in Part IV.A, mirroring the model of judgment XI ZR 91/14.14 Designed in this way, the evidentiary rule and the technical security duty reinforce each other: the presumption gives stability to transactions, while the security requirement prevents the presumption from becoming a tool for shifting all risk onto the signatory.
Conclusion
Recognising digital signatures as equivalent to handwritten signatures is necessary but not sufficient. As long as the law does not specify the procedural consequences of a valid digital signature, courts will continue to fill the gap with standard-form contract terms, producing the inconsistent outcomes observed in practice. This article proposes a three-tier structure: a rebuttable presumption for digital signatures with enumerated rebuttal grounds (Part IV.A); an allocation of the burden of proof according to the reliability of the signing process for other electronic signatures (Part IV.B); and a condition that the benefit of the presumption depends on proof of system security (Part IV.C). This structure secures the predictability of electronic transactions while allocating risk to the party best placed to control it.
*****
Footnotes
1. Luu Quoc Trang & Tran Nguyen Trong Thanh, Chứng cứ điện tử trong tố tụng dân sự – Một số bất cập và kiến nghị hoàn thiện [Electronic Evidence in Civil Proceedings: Shortcomings and Recommendations for Improvement], Tạp chí Tòa án nhân dân [People’s Court Journal] (online) (Jan. 26, 2026), https://tapchitoaan.vn/chung-cu-dien-tu-trong-to-tung-dan-su-mot-so-bat-cap-va-kien-nghi-hoan-thien14890.html.
2. Bộ luật Tố tụng dân sự [Civil Procedure Code], No. 92/2015/QH13, arts. 94(1), 95(3) (Nov. 25, 2015), as amended (Viet.).
3. Luật Giao dịch điện tử [Law on Electronic Transactions], No. 20/2023/QH15, art. 11(2) (June 22, 2023) (effective July 1, 2024) (Viet.).
4. Civil Procedure Code, supra note 2, arts. 91(1)–(2), 92, 108(2).
5. Law on Electronic Transactions, supra note 3, arts. 22(3)(d), 23(2).
6. Tòa án nhân dân tỉnh Bắc Ninh [People’s Court of Bac Ninh Province], appellate civil judgments of July 2, 2024 and July 3, 2024 (Viet.), reported in Do Men, Vụ tài khoản ‘bốc hơi’ 26,5 tỷ đồng: Vì sao ngân hàng không phải bồi thường? [The VND 26.5 Billion Account Case: Why the Banks Were Not Liable], VnEconomy (July 4, 2024), https://vneconomy.vn/vu-tai-khoan-boc-hoi-26-5-ty-dong-vi-sao-ngan-hang-khong-phai-boi-thuong.htm; see also Danh Trong, Vụ khách hàng bị lừa 14,6 tỉ kiện Techcombank: Tòa tuyên ngân hàng không phải bồi thường [Customer Defrauded of VND 14.6 Billion Sues Techcombank: Court Rules the Bank Need Not Compensate], Tuổi Trẻ (July 3, 2024), https://tuoitre.vn/vu-khach-hang-bi-lua-14-6-ti-kien-techcombank-toa-tuyen-ngan-hang-khong-phai-boi-thuong-20240703062212941.htm; Danh Trong, Vụ khách hàng mất 11,9 tỉ: Tòa tuyên ‘lỗi do khách hàng, không phải do Vietcombank’ [Customer Loses VND 11.9 Billion: Court Rules the Fault Lies with the Customer, Not Vietcombank], Tuổi Trẻ (July 3, 2024), https://tuoitre.vn/vu-khach-hang-mat-11-9-ti-toa-tuyen-loi-do-khach-hang-khong-phai-do-vietcombank-20240703155717922.htm.
7. Zivilprozessordnung [ZPO] [Code of Civil Procedure], as promulgated Dec. 5, 2005, BGBl. I at 3202, as amended, § 371a(1) (Ger.), https://www.gesetze-im-internet.de/zpo/__371a.html.
8. Bundesgerichtshof [BGH] [Federal Court of Justice] Jan. 26, 2016, XI ZR 91/14, 208 Entscheidungen des Bundesgerichtshofes in Zivilsachen [BGHZ] 331, paras. 38, 46 (Ger.).
9. Ruiz v. Moss Bros. Auto Grp., Inc., 232 Cal. App. 4th 836, 843–44 (2014) (applying Cal. Civ. Code § 1633.9(a)).
10. Espejo v. S. Cal. Permanente Med. Grp., 246 Cal. App. 4th 1047, 1053–54, 1062 (2016).
11. See sources cited supra note 6 (appellate court applying the bank’s terms and conditions excluding liability for losses caused by the customer’s disclosure of authentication data).
12. Trans-Pacific Partnership Agreement art. 14.6(2)(b), Feb. 4, 2016, incorporated by Comprehensive and Progressive Agreement for Trans-Pacific Partnership art. 1(1), Mar. 8, 2018, https://www.international.gc.ca/trade-commerce/trade-agreements-accords-commerciaux/agr-acc/tpp-ptp/text-texte/14.aspx?lang=eng.
13. Nghị định số 23/2025/NĐ-CP quy định về chữ ký điện tử và dịch vụ tin cậy [Decree No. 23/2025/ND-CP on Electronic Signatures and Trust Services], arts. 26(1)(c), 37(4) (Feb. 21, 2025) (effective Apr. 10, 2025) (Viet.); cf. id. arts. 36(2)(c)–(d) (for certificates issued electronically, suspension where suspicious transactions are detected in the signing process, and retention of identification data and transaction logs), 41(1) (suspension of a subscriber’s certificate on the subscriber’s verified written request, or where the provider detects risks, irregularities or suspicious transactions in the signing process).
14. BGH, XI ZR 91/14, supra note 8, para. 46.