Functional Grammar Analysis of Bank Scam SMS/Text/zalo in Vietnam

Authors by Bui Phuong Anh and Vo Thi Binh An

1. Introduction (Phuong Anh)

1.1 Background
Online fraud has emerged as a significant issue globally, and Vietnam is no
exception to this growing threat. As digital communication platforms have
revolutionized the way people connect, they have also presented an avenue for
scammers to exploit these platforms' vulnerabilities for their own gain. One of the
most targeted platforms in Vietnam is Zalo, a messaging application that has
quickly become one of the most popular communication tools in the country,
boasting millions of active users. The widespread usage of Zalo, paired with its
popularity as a personal communication medium, makes it an ideal target for
scammers seeking to manipulate unsuspecting individuals.
Zalo, unlike traditional forms of communication, offers a more intimate and
personal means of interaction between users. This environment is ripe for
exploitation by scammers, who can easily impersonate trusted figures such as
friends, family members, or employees from legitimate organizations. Through
these impersonations, scammers gain access to sensitive personal information such
as bank account details, passwords, and even money. These scams often start with
messages that seem harmless at first glance. For instance, a victim may receive a
message from a supposed relative asking for financial help due to an emergency or
claiming to be in a desperate situation. Other types of scams involve falsely
informing the victim that they have won a lottery or a grand prize, prompting them
to send an upfront payment to claim the winnings.
At the core of these fraudulent activities is psychological manipulation, where
the scammer takes advantage of the victim’s emotional state to compel immediate
action. Creating a sense of urgency or emotional distress is a key tactic used by
scammers. The idea is to pressure the victim into making quick decisions without
fully considering the consequences. This emotional manipulation is often
accompanied by the use of urgent, sympathetic, or threatening language. These
emotional triggers distract the victim from critically evaluating the message and
significantly increase the likelihood of them falling victim to the scam.
According to the 2024 Cybersecurity Report published by the National
Cybersecurity Association, the scale of this problem is staggering. The report
indicates that for every 220 smartphone users, one will fall victim to online fraud.
In Vietnam, the total estimated damage caused by online scams in 2024 was
approximately 18,900 billion VND. Among the various types of online fraud,
investment scams were the most prevalent, with fraudsters offering high returns
with minimal risk, luring victims into fraudulent schemes. Additionally, imposter
scams, where criminals impersonate government officials, police officers, or
representatives of financial institutions, have also been on the rise. These scams
manipulate victims into sharing private information or transferring money to
fraudulent accounts.
Despite growing public awareness and media coverage of these issues, the
response from the general public and law enforcement remains alarmingly low.
According to the same report, only 45.69% of fraud victims report their
experiences to the authorities. This lack of reporting is symptomatic of a larger
systemic problem, where many victims are either unaware of how to report scams
or feel powerless to take any action. The failure to report these frauds exacerbates
the situation, preventing law enforcement agencies from investigating and
addressing the issue adequately. Consequently, this leads to an ongoing cycle of
scams, causing more financial losses and emotional distress for victims.
To combat this problem, it is crucial to foster a culture of greater fraud
reporting and strengthen systems for fraud detection and prevention. Public
education campaigns designed to raise awareness about common scam tactics and
how to report them, as well as improvements in reporting mechanisms, could play a
pivotal role in empowering victims to act more swiftly and reduce the number of
fraudulent activities.
1.2 Research Gap
While a significant body of research has examined online fraud and scams in
general, most studies have focused on scams carried out via email phishing, fake
job advertisements, and scams occurring on various social media platforms. In
contrast, there is limited academic exploration specifically targeting scams that
occur on Zalo, which presents its own set of unique challenges for both scammers
and victims, primarily due to the platform's more personal and conversational
communication style. The lack of research on Zalo scams represents a substantial
gap in the literature, one that this research intends to fill.
Existing studies on online fraud typically concentrate on the structural aspects
of scams, such as identifying the types of fraudulent offers scammers use,
analyzing the tactics employed, or investigating the psychological mechanisms
behind these activities. While these studies provide valuable insights into how
scams operate, they often overlook the role of language in facilitating these
fraudulent schemes. The use of language to build trust, establish legitimacy, create
urgency, and manipulate emotions is a crucial yet often underexplored area.
This study seeks to bridge this gap by applying Functional Grammar (FG) to
examine the language used by scammers on Zalo. Functional Grammar offers a
comprehensive approach to understanding how language functions in
communication. By focusing on the ideational, interpersonal, and textual functions
of language, FG allows us to analyze how scammers manipulate language to
deceive and control their victims. Unlike traditional research that focuses primarily
on sentence structures or syntax, FG emphasizes how language serves specific
communicative purposes- persuasion, manipulation, and deception- within a
particular context.
Through this approach, this research will explore how scammers use language
on Zalo to construct deceptive narratives, emotionally manipulate their victims, and
craft messages that persuade victims to act hastily. By analyzing these linguistic
strategies, we can gain a deeper understanding of how scammers operate and
uncover methods to better detect and counter these scams. The insights gained from
this study will be valuable not only for academic purposes but also for developing
more effective strategies for fraud detection and prevention.
1.3 Chapter Overview
This chapter is structured as follows: In the first section, the Literature Review
will provide an overview of existing research on scam discourse and the application
of Functional Grammar to deceptive and manipulative language. The second
section, Data and Methodology, will describe the sources of data, how it was
collected, and the methods employed for analyzing the data. In the third section, the
Analysis, we will apply Functional Grammar to scam messages collected from Zalo
conversations. This section will focus on identifying how scammers manipulate
language to deceive and control their victims. The chapter will conclude with
Findings and Implications, where the results of the analysis will be summarized,
and recommendations for improving fraud detection and prevention strategies will
be presented.
2. Literature Review (Phuong Anh)
2.1 Scams and Deceptive Discourse
Deceptive discourse has long been a central subject in communication and
linguistics studies, particularly as the scope of online fraud continues to expand.
Deceptive discourse refers to language that is intentionally used to mislead,
manipulate, or deceive others into taking actions that harm them, often financially
or psychologically. In the case of scams, deceptive discourse becomes a tool for
fraudsters who manipulate victims into taking actions- such as transferring money
or sharing personal information- that ultimately result in financial loss.
Extensive research on scam discourse examines how fraudsters use language to
construct persuasive but fraudulent messages. Robert Cialdini's principles of
persuasion- such as reciprocity, scarcity, and authority- are key psychological
tactics that scammers use to exploit victims. These principles explain how
scammers can manipulate victims' emotional and psychological responses, such as
fear, greed, or urgency, to compel them to act impulsively. For example, scammers
often invoke urgency (e.g., “You must act now to claim your prize”) or scarcity
(e.g., “This offer is limited, act before it’s too late”) to pressure the victim into
responding quickly, without taking time to critically evaluate the situation.
However, while these psychological factors are crucial for understanding how
scams function, existing literature often fails to account for the linguistic strategies
used by scammers to create such effects. Although emotional manipulation is a
central part of scams, it is often intertwined with specific linguistic choices that
serve to reinforce urgency, authority, and legitimacy. Fraudsters may use phrases
like “I need your help” or “This is urgent” to create a sense of immediate action.
These phrases bypass the victim’s rational defenses and trigger an emotional
response, making the scam appear less suspicious and more believable.
 Although much of the existing literature on scams focuses on more traditional
forms of fraud, such as email phishing or fake job advertisements, the role of social
messaging platforms like Zalo has not been adequately explored. Zalo offers a
unique avenue for scammers due to its informality and personalized nature. The
conversational style of Zalo messages, often between friends or close
acquaintances, offers a fertile ground for fraudsters to manipulate their victims. The
ease with which scammers can impersonate family members, friends, or trusted
organizations on such platforms makes them particularly effective. This study aims
to fill the existing gap in the literature by exploring how scammers use linguistic
strategies on Zalo to manipulate their victims.
2.2 Functional Grammar and Deceptive/Manipulative Language
Functional Grammar (FG), a linguistic framework developed by M.A.K.
Halliday, focuses on understanding how language is used in communication to
achieve particular goals. Unlike traditional grammatical approaches that prioritize
syntax and sentence structure, FG emphasizes how language functions in real-
world interactions to fulfill social purposes. In the context of scams, FG helps to
reveal how language is strategically manipulated to persuade, deceive, and control
victims.
FG proposes that language serves three core functions: ideational,
interpersonal, and textual. Each of these functions contributes to how scammers
structure their messages to manipulate victims:
 Ideational function: Refers to how language represents events,
processes, and participants. In scams, this function is used to create
fraudulent representations of reality. For example, scammers may describe a
fraudulent investment scheme as a legitimate opportunity or an urgent legal
matter to create a false sense of legitimacy.
 Interpersonal function: Focuses on how language establishes
relationships and influences the behavior of others. In scams, this function is
crucial because scammers rely on language to manipulate the victim’s
emotions and responses. By using different moods (imperative, interrogative,
or declarative), scammers can assert their authority and press the victim into
compliance.
  Textual function: Concerns how information is organized within a
message to ensure coherence and persuasiveness. Scammers use this
function to structure their messages in a way that guides the victim’s
attention to the most important points, ensuring that the message is
convincing and difficult to question.
In this study, Functional Grammar will be applied to Zalo scam messages to
analyze how scammers utilize these three functions to construct deceptive
narratives, emotionally manipulate victims, and ensure their messages are
persuasive and effective.
3. Data and Methodology (Phuong Anh)
3.1 Data Description
This research focuses on analyzing scams on Zalo. Data was collected from a
variety of sources to ensure a comprehensive understanding of how scammers
exploit the platform.
 Source: The primary sources of data include:
o Publicly shared scam conversations on anti-scam forums and
social media platforms.
o Victim testimonies, including screenshots and reports of scam
messages.
o News articles and police reports related to fraud cases involving
Zalo.
 Volume: The dataset consists of:
o 50 unique Zalo scam conversations, which provide a rich
variety of interactions.
o The total word count of these conversations exceeds 12,000
words.
 Modality: The dataset consists mainly of text-based data from Zalo
conversations, but also includes audio recordings of scam phone calls made
via Zalo. These calls were recorded by victims who encountered fraudsters
posing as trusted individuals, such as bank representatives or government
officials. Additionally, screenshots of fraudulent Zalo profiles and scam
requests were also included.
  Ethical Considerations: Ethical considerations were paramount in this
study. All personal identifying information such as names, phone numbers,
and other details were redacted to maintain privacy. Informed consent was
obtained from the victims whose data was used in the analysis, ensuring that
all materials were anonymized before being processed.
 Transcription/Preparation: All data, including text conversations and
audio recordings, were transcribed verbatim. Specific transcription
conventions were followed to capture non-verbal cues, such as tone and
pauses, which are crucial for understanding the emotional context of the
messages.
3.2 Analytical Framework: Functional Grammar
Functional Grammar (FG), developed by M.A.K. Halliday, provides a rich and
flexible framework for analyzing how language functions in communication.
Rather than focusing solely on syntax (the structure of sentences), FG emphasizes
the social purposes language serves in communication. This framework is
especially useful for analyzing manipulative and deceptive discourse, like that
found in online scams, because it allows us to understand not only the structure of
language but also how it works to persuade, deceive, and manipulate.
FG divides language into three main functions, each playing a crucial role in
shaping meaning within communication:
1. Ideational Function: How language represents actions, events, and
experiences in the world.
2. Interpersonal Function: How language establishes and manages social
relationships between the speaker and the listener.
3. Textual Function: How information is structured to create coherent
and persuasive communication.
By analyzing these functions, we can unpack the linguistic strategies scammers
use to craft deceptive messages that manipulate victims on Zalo. This section will
provide a detailed look at each of these three functions and how they are applied in
analyzing scam messages.
 3.2.1. Ideational Function: Constructing the Deceptive Narrative
The ideational function is primarily concerned with representation -that is, how
language is used to represent the world, particularly through actions, participants,
and circumstances. In scams, the ideational function is essential because it shows
us how scammers construct fraudulent narratives. They use language to create false
representations of reality, persuading the victim that something (often urgent or
emotionally distressing) is occurring, when in fact it is not.
Transitivity analysis, a key tool in FG, is employed to break down and examine
the processes (verbs), participants (nouns or pronouns), and circumstances
(adverbials or prepositional phrases) that structure these representations.
Transitivity analysis helps us identify how scammers frame actions in such a way
that manipulates the victim into responding as desired.
 Processes: Scammers use different types of processes, such as material
processes (actions or events), relational processes (defining relationships),
and mental processes (perceptions, emotions, or cognition), to manipulate
the victim’s understanding of a situation. For example, a material process
like “send” (as in “send money now”) directly urges the victim to take
action. In contrast, relational processes like “you are a winner” or “this is
urgent” help the scammer construct a false reality that appeals to the victim's
desire for reward or fear of consequences.
 Participants: The roles played by different participants in scam
messages are carefully crafted. Scammers often use agentless constructions
to conceal their true identity and make the message appear more legitimate.
For example, a scammer might say, “You have been selected for a prize”
rather than directly stating, “We have selected you for a prize,” thus
removing themselves as the direct agent in the message. This strategy shifts
the focus onto the victim’s perceived good fortune, making it easier to
manipulate their emotions.
 Circumstances: Scammers often set up a deceptive context by using
adverbs or prepositional phrases that indicate urgency or pressure. For
example, “right now,” “immediately,” or “within the next 24 hours” are
commonly used in scams to create a sense of urgency. These circumstances
 help trigger the fight-or-flight response, compelling the victim to act quickly
without thinking critically about the situation.
By analyzing these elements, we can uncover the techniques scammers use to
construct convincing, yet fraudulent, stories that manipulate the victim's perception
of reality.
3.2.2. Interpersonal Function: Manipulating Relationships and Social
Influence
The interpersonal function deals with how language establishes social
relationships and influences the behavior of others. In scams, this function plays a
pivotal role because it allows the scammer to create a connection with the victim,
often making the message feel personal and urgent. This connection is essential for
building trust and convincing the victim to comply with the scammer’s requests.
One of the most powerful tools in the interpersonal function is mood analysis,
which involves examining the mood of a sentence (whether it is declarative,
imperative, interrogative, or exclamatory) to understand how the scammer is
attempting to influence the victim’s behavior. Scammers use different moods to
establish dominance, create urgency, and manipulate the victim’s emotions.
 Imperative Mood: Scammers frequently use the imperative mood
(commands or directives) to control the victim’s actions. Phrases like “send
money now,” “click here,” or “act immediately” are direct instructions
designed to spur immediate action. The use of imperatives leaves little room
for the victim to question the request, thus asserting control over the
interaction.
 Interrogative Mood: The interrogative mood (questions) is often used
to subtly manipulate the victim into taking action or disclosing information.
For example, a scammer may ask “Why haven’t you responded?” or “What’s
stopping you from acting now?” These questions imply that the victim is
delaying or not following the scammer’s instructions, creating a sense of
guilt or pressure. The victim may feel obligated to act quickly to avoid
negative consequences or to maintain the relationship with the scammer.
 Declarative Mood: Scammers also rely on the declarative mood to
assert authority and provide false assurances. Phrases like “This is
legitimate” or “You are guaranteed to win” are used to make the scam appear
 more credible and professional. The use of the declarative mood reinforces
the illusion that the scammer is a trustworthy source of information.
Furthermore, modality plays a significant role in scams by helping to convey
necessity, obligation, permission, or probability. Scammers often use modal verbs
(e.g., must, should, have to, can, will) to assert urgency or to make their demands
appear more pressing and non-negotiable. For example, phrases like “You must
transfer the funds immediately” or “You should act now to avoid consequences”
are commonly used in scams to coerce the victim into taking hasty actions. By
using high modality, scammers make the victim feel like there is no other option
but to comply.
By examining these interpersonal strategies, we can better understand how
scammers establish and manipulate social dynamics to elicit compliance from the
victim.
3.3.3. Textual Function: Creating Coherent and Persuasive Messages
The textual function focuses on how language is organized within a message to
ensure coherence and persuasiveness. Scammers use various techniques to structure
their messages so that they flow logically and are easy to follow, making the fraud
appear more legitimate and reducing the likelihood of the victim questioning the
scam. The textual function is essential in ensuring that the scammer's message is
clear, cohesive, and convincing.
Theme-Rheme analysis is used to analyze the way information is presented and
structured within a message. The theme is typically the starting point of a sentence
or clause, and it sets the focus for the message. The rheme, on the other hand,
provides new information. Scammers often place the most important or persuasive
information in the theme to capture the victim’s attention immediately. For
instance, scammers might begin with phrases like “You are the winner” or
“Immediate action required” to draw the victim’s focus to the most critical part of
the message.
Additionally, scammers use cohesion devices- such as conjunctions (e.g.,
“and,” “because,” “therefore”) and referential devices (e.g., “this,” “it,” “they”) - to
ensure that their messages flow logically. These cohesion devices link ideas and
ensure that the message seems coherent and well-structured. Even if the underlying
message is false, these linguistic devices help the scammer present the information
in a way that feels more convincing and professionally organized. For example, a
scammer might say, “This is urgent, and you must respond immediately to avoid
legal action.” Here, the conjunction “and” links two key pieces of information,
creating a smooth flow that makes the message appear more legitimate.
By using textual cohesion strategies, scammers can craft messages that seem
more coherent and persuasive, reducing the victim's suspicion and increasing the
likelihood of compliance.

4. Analysis and Discussion (Binh An)

In this section, I will analyze bank fraud information through three main functions of
ideational grammar: concept, interpersonal and texttual. The language pattern of
analysis clearly shows how cheaters design information to create false reality,
manipulate emotions and guide the behavior of recipients.

Conceptually, transitivity shows that scammers give priority to the action process to
build a sense of urgency and intervention. Verbs such as “lock”, “update”,
“authentication” and “stop using” usually appear with ‘we” or “bank”. For example,
in the sentence “If we are not authenticated, we will lock your account”, this
structure describes a powerful action from “we”-a representative of false power,
while “your account” is a passive and vulnerable object. In addition, the relationship
process is also used to describe the account status, such as “not updated” and
“invalid”, which will produce defects that need to be dealt with. Psychological
processes appear in sentences such as “We have detected abnormal activities” - this
is how scammers activate the fear of invasion to stimulate the victims' quick
response. In terms of vocabulary, fraudsters use bank professional vocabulary
combined with legal vocabulary and emergency expression. Clusters such as “verify
now”, “force within 24 hours” and “secure link” are used to improve reliability and
exert pressure.

In terms of text structure, messages usually start with threatening or unfavorable

information-for example, “There is something wrong with your account”-in the
subject position so as to attract attention from the beginning. The next section
(Rheme) will provide operating instructions, such as “Please verify in the link
below” to create a clear and easy-to-understand information flow. Link media, such
as “if”, “and”, “or”, and repeated keywords, such as “authentication”, “secret” and
“link”, help to maintain the connectivity and connectivity of the text, even if the
content is deceptive. If there are multimedia elements such as bank logo,
professional color format or real domain name link, these elements will increase the
false authenticity and support the language content to convince readers more
effectively.

Generally speaking, deceptive information is purposefully constructed according to

language functions, with the purpose of reproducing a seemingly credible reality and
getting a quick response from the victims.

4.1 Ideational Meaning: Constructing the Deceptive Reality

In semantic analysis, the focus is on how the deceiver constructs the linguistic
reality to deceive the truth of the victim's information. According to the analysis of
Transitivity, most sentences in fraudulent information use material processes-that
is, operational processes-such as “lock”, “update”, “access” and “verification”.
These verbs describe the specific behavior used by fraudsters to threaten or guide
victims.

Take the data as an example:

“If we don't confirm it immediately, we will lock your account”.

“We will lock your account if you don't authenticate immediately”.

“We will lock your account if you don't verify it now”.

In the above example, “We” acted as the agent of a powerful organization (bank)
and performed the action of “locking”, while “Your account” was the “target”-the
affected object. The conditional combination of ‘if you don't confirm” plays a
“conditional” role and produces a sense of threat.

In addition, relationship processes are used to identify negative or missing states in

accounts:

“Your account has not been updated”.

“Your account has not been updated”.

This sentence has no direct action, but establishes a warning reality and requires the
recipient to take action. The “not updated” status plays the role of negative
information, which makes readers feel anxious.

Some sentences use psychological processes such as “discovery”, “doubt” and

“worry” to establish rationality and dampen readers' emotions:

“The system has detected abnormal activity from your account”.

“The system has detected unusual activity from your account”.

Here, the “discovery” action shows the ability of perception or evaluation, and it is
assigned to a seemingly neutral entity as a ‘system”, which makes the receiver trust
more.

In terms of vocabulary, scammers use the combination of multiple fields to increase

reliability and persuasiveness. An important part is financial terms, such as
“account”, ‘verification”, “finance” and “threshold”; In addition, there are legal
terms such as “temporary”, “stop providing” and “safety decision”. In addition,
language often has vague and authoritative colors such as “secure link”, “official
page” and “security guarantee”, which makes it difficult for readers to identify false
butcredible content.

In particular, urgent and mandatory expressions such as “immediately”, “within 24

hours” and “compulsion” are constantly appearing to generate pressure for
immediate action.
 4.2 Interpersonal Meaning: Manipulating the Victim and Building
Deceptive Rapport:
 In terms of communication semantics, emotional analysis shows that
fraudulent information mainly uses imperative and declarative to establish
simulated power. For example:

“Please confirm the information in the link below”.

“Please verify your information immediately through the link below”.

Although the word “happy” is used, it is actually a disguised polite command,

which aims to produce a feeling of support rather than coercion. The sentence
must be like:

“Your account has been frozen”.

“Your account has been temporarily locked”.

This sentence indicates the completed action, which makes the receiver feel that
they have no choice but to follow the instructions.

Interrogative rarely appears, but its purpose is to trigger interaction or test

response:

“Have you done any trading recently?”

“Have you made any transactions recently?”

This sentence may make the recipient re-check his real account, inadvertently
giving people a feeling that there is a real problem.

As for morphology, swindlers use multiple morphological verbs to express the

degree of coercion and certainty. Verbs, such as yes, should, should and will, are
usually accompanied by forms such as immediately, within 24 hours, compulsion
and necessity. For example:

“You must update the information within 24 hours to avoid the account being
locked”.

“You must update your information within 24 hours to avoid suspension of your
account”.
The above sentence clearly expresses the compulsion to create a sense of urgency
through “correctness” and the serious consequences that follow “avoiding being
locked in an account’’.

According to Appraisal Theory, liars also skillfully use attitude and emotional
factors. Expressions express concern, such as:

"We regret the possible accident.”

“We regret any potential problems that may occur.”

Express false empathy to build trust, and sentences such as:

“If it is not handled in time, your account may lose access rights permanently.”

“If it is not resolved in time, your account may be permanently disabled.”

“ inspire fear and loss.”

As for pronouns, “we” is used to create a feeling, which is the information from
authoritative organizations, and “you” is always the affected object and needs to
fulfill obligations or deal with problems. There is a clear dividing line between
“having the right to give orders” and “having the obligation to obey”.

4.3 Textual Meaning: Organizing the Deceptive Message

In terms of information structure, topic-root analysis shows that deceptive
information usually puts threats or unfavorable factors in the topic position in
front of sentences to guide attention. For example:
“Your account shows signs of illegal access”,
“Your account shows unauthorized access.”
This sentence puts the problem in the first place, making readers panic
immediately, before the Rheme part (the next line) gives instructions such as
“please verify it here”. This arrangement helps to create a tight and easy-to-master
information flow, while improving the victim's ability to act.

Regarding connectivity, messages use common conjunctions, such as “if”, “and”

or “to create logical circuits; Use links such as Links below”, “This Information”
and “Your Account” to maintain the integrity of the content. Lexical cohesion is
embodied by purposefully repeating words such as “authentication”,
“confidentiality” and “account” to consolidate the central theme and create a
sense of professionalism.

For multimedia data, visual elements such as bank logo, unique blue color, lock
icon or format similar to bank application interface are all helpful to enhance
persuasiveness. In some cases, scammers use machine voice and use gentle
female voice in short messages, which begins with:

“Hello, this is ACB bank headquarters.”

The use of this listening skill makes it difficult for listeners to distinguish between
true and false, especially when it is combined with professional language
expression in pronunciation.

5. Findings and Implications (Binh An)

5.1 Summary of Key Findings: Synthesize the Most Significant Linguistic
Patterns Identified Through Your FG Analysis
 Based on the analysis of Functional Grammar (FG), some prominent language
patterns have been identified, which show that deceivers use language in a
systematic and computational way to deceive recipients. First of all, at the
conceptual level, the main processes used are material processes such as
“locking”, “updating” and “visiting”, indicating that if the receiver does not
comply, it will emphasize specific actions and consequences. Relationship
processes such as “unverified” and “invalid” play a role in establishing a negative
state and create a premise for intervention. Psychological processes such as
“discovery” and “doubt’ are used to increase the rationality of intelligent systems
and forge warning emotions.
The participant is clearly expressed by using pronouns: “We” often appears in the
role of an agent-the representative of a false banking organization-while “You” is
the affected person, always in a passive state and influenced by the power side.
This helps scammers locate their victims in an asymmetric relationship structure,
which makes it easier to control their behavior.
Secondly, at the communication level, emotions such as commands and
affirmative sentences are used, and sometimes problems can be flexibly adjusted
to produce pressure and cooperation. Morphological verbs, such as “yes”,
“should” and “need”, are combined with time phrases such as “immediately” and
“within 24 hours” to generate a sense of urgency. In addition, the language that
combats the emotions of the recipients has also become an effective tool to
express the expression of empathy (We are sorry), false compliments (Thank you
for using our service) or mild threats (Account may be suspended).
Thirdly, at the level of text structure, information is usually structured in the
direction of topic-root, so as to put shock or threat elements at the top of sentences
before leading to action guidance. The link point is maintained by the link
medium, such as “if…”. Quoted words such as it, link below, and repeated
professional words such as authentication, confidentiality and account. In
addition, multimedia elements, such as false signs, link formats and voice, also
helps to strengthen fraud.
Generally speaking, the language structure in deceptive messages is a rigorous
system with clear strategies. This proves that swindlers not only manipulate the
content, but also make full use of the form and structure of language to produce
strong psychological effects.

5.2 Contribution to Understanding Scam Discourse: Deepening Insights

into Deceptive Language in the Vietnamese Context
 The findings from this study contribute significantly to the understanding of
how scammers operate scam discourse in the Vietnamese language. Unlike scam
discourse patterns in English, Vietnamese messages often take advantage of
Vietnamese grammatical features such as the flexibility of pronouns, the
ambiguity of conditional clauses, and the ability to use urgent adverbs with modal
verbs to strongly impact the reader's emotions.
In addition, the use of polite honorifics such as “vui xin”, “quy khach”, “xin
luu nghi” in imperative contexts is a unique feature in the Vietnamese context. It
not only makes the message easier to receive but also blurs the line between
request and imposition, thereby increasing the likelihood that the recipient will
comply.
It is worth noting that scammers also imitate the writing style of domestic
banking organizations, from the way they open messages to the way they insert
logos, specific times, bank symbols, “almost real” website addresses, and even
phrases like “according to the regulations of the State Bank” are often used. This
proves that scammers are not only good at technology but also have a deep
understanding of Vietnamese language culture and user behavior.
Thus, the study not only helps expose how language is used to deceive in each
sentence, but also contributes to expanding understanding of how language tricks
adapt to each specific language community – in this case, Vietnamese.

5.3 Practical Implications

Scam Prevention: Public Awareness and Education
The linguistic findings from this study can provide strong support for anti-
fraud communication campaigns. Public disclosure of typical sentence patterns,
grammatical structures, and word choices of phishing messages can help ordinary
users easily recognize risks. Posters, instructional videos, and digital literacy
courses can be built on the analyzed FG patterns.
For example, if users are taught that messages with the content “your account
has been locked”, accompanied by unofficial links, often use the modal “must”
and time phrases such as “within 24 hours”, they will be more cautious when
interacting.
Detection: Supporting Algorithm and Expert-Based Identification
The results of functional linguistic analysis can also serve as the foundation
for automated fraud detection systems. Modeling criteria such as mood, modality,
lexis, theme-rheme, etc. can be integrated into linguistic filters in artificial
intelligence systems to identify suspicious text.
 For example, machine learning algorithms can be trained to detect when
forced modal verbs and short-term time clusters co-occur; this increases the
probability that the message is a scam. In addition, forensic and cybersecurity
experts can also use FG models to analyze evidence in cases involving high-tech
crimes.
Policy: Enhancing Cybersecurity Strategy and Regulation
Finally, FG analysis results can provide a linguistic science foundation for the
development of information security policies and regulations. Specifically,
functional agencies such as the Ministry of Information and Communications,
commercial banks, or consumer protection units can use this result to build an
official fraud language identification set. From there, the content of warnings to
people will be more realistic, not general like "beware of strange messages", but
will be specific to each dangerous structure such as "we will block your account",
"please verify here".
In addition, through FG, policy makers can clearly understand the relationship
between language structures and user behavior, thereby building laws and
standardizing digital interaction content between people and organizations to
minimize the space for fraudulent behavior to develop.

6. Conclusion (Binh An)

 This study makes a comprehensive analysis of bank fraud information through
the lens of systemic functional grammar to illustrate how language is used as a
tool to manipulate the cognition, emotion and behavior of recipients. By analyzing
three metaphysical functions-ideality, interpersonal ommunication and textural
structure, the research shows that the language in deceptive information is not
random, but deceives the victim in a short time in a strategic, systematic and
purposeful way.
Firstly, semantic analysis shows that fraudsters mainly use material process to
describe behaviors such as “locking accounts”, “updating information” and
“instant verification’’, thus creating a false reality that user accounts are in danger
and need to take urgent action. In addition, the relationship processes such as
“invalid” and “not updated” help to shape the negative state, while the
psychological processes such as “discovery” and “doubt” help to improve
persuasiveness and enable the banking system to monitor users' personal
activities. This puts the receiver in an unsafe state and makes it easy to make
unconfirmed decisions.
Thirdly, at the level of text structure, the topic -rheme arrangement is used to
guide the recipients to pay attention to the threatening factors or shocking
information at the beginning of the sentence. This helps to guide attention and
activate quick emotional reactions. Language linking media, such as conjunctions
“if ...” and quotations “this link” and “your account” ensure that the text is smooth
and easy to understand, even if the content is forged. In particular, multimedia
elements, such as the image of the bank logo, the analog interface of the bank
application, or the voice of “announcer” in the telephone short message, increases
the reliability and makes it difficult for the recipient to doubt.
Generally speaking, the findings of this analysis show that deceptive speech-that
is, deceptive speech-is not only the use of technology or technology, but also the
thorough use of language mechanism to establish a seemingly legal, convincing
and reliable communication space. This is one of the reasons why many victims,
even those with higher education, may be cheated after a few short messages.

Another limitation is that the psychological factors of user behavior have not been
embedded in the analysis. Although FG analysis is helpful to understand the
linguistic mechanism of deception, the user's reaction-the process of receiving,
processing and deciding feedback-depends on many non-linguistic factors, such
as technical usage habits, trust in banks or information security knowledge. These
factors need to be supplemented in future interdisciplinary research.
In view of the above limitations, some further research directions can be put
forward. First of all, we need to extend the analysis data to other forms of fraud,
such as email phishing, deep vacation voice calls or fake banking applications.
 Secondly, language analysis should be combined with user behavior analysis in
order to understand the cheating effect more comprehensively. Third, future
research may develop a machine learning model based on FG features to detect
fraud in the digital environment more effectively and accurately.
In a word, this study shows that language is not only the transmission medium of
information, but also a tool to control cognition and behavior under the
background of deceptive information.

References
Halliday, M. A. K. & Matthiessen, Christian (2013). Halliday’s Introduction to
Functional Grammar (4th ed.). London: Routledge.
Eggins, Suzanne (1994). An Introduction to Systemic Functional Linguistics.
London: Edward Arnold.
Integrating Systemic Functional Grammar in Vietnamese EFL Teaching
Authors by Bui Phuong Anh and Vo Thi Binh An

I. Introduction
In recent years, the demand for improving English language proficiency in
Vietnam has been increasing, especially in the context of international
integration. However, one of the outstanding challenges for English as a foreign
language (EFL) learners in Vietnam is the ability to use the language flexibly and
effectively in academic and practical communication situations. Traditional
grammar, which focuses on memorizing rules and sentence structures, is not
capable of equipping learners with the tools to express complex and social
meanings. In this context, Systemic Functional Grammar (SFG) has emerged as a
potential approach, not only helping learners understand language as a meaning-
making system, but also supporting the development of critical thinking,
academic writing skills, and the ability to communicate in specific contexts.
1. Theoretical basis:
Common difficulties of English learners in Vietnam Common grammatical
errors: Vietnamese students often make mistakes in using tenses, relative
clauses, passive structures, and especially in organizing information in
sentences and paragraphs. Difficulty in expressing complex meanings:
Learners often encounter obstacles when needing to express cause-effect
relationships, conditions, choices or logical arguments in academic writing or
 presentations. Limitations in academic writing and reading specialized texts:
Lack of understanding of genre characteristics and how to organize
information according to theme/rheme makes it difficult for learners to write
and read academic articles.
2. Benefits of integrating SFG
Different from the traditional rule-based grammar method, SFG regards
language as a means to create meaning in the social environment. Concepts
such as transitivity, mood, theme/rheme or general analysis can not only help
learners to understand how language works, but also help them to know how
to choose a language suitable for communicative purposes.
II. Research questions:
1. How does the application of the Theme-Rheme concept in teaching
academic writing affect the information organization ability of EFL
students in Vietnam?
2. How do EFL students in Vietnam respond when participating in SFG-
based learning activities?
3. What are teachers' perceptions of the feasibility and usefulness of
SFG-informed pedagogy?
4. What challenges and enablers affect the implementation of SFG in
this context?

III. DATA AND METHODS

1. This is an action research study conducted in an English as a Foreign Language
(EFL) classroom at a university in Vietnam. The aim of the study is to evaluate the
effectiveness of integrating Systemic Functional Grammar (SFG), specifically the
concept of Theme – Rheme, into teaching academic writing to intermediate level
students.
2. Participants The study is planned to be conducted with a group of about 20–30
second-year students majoring in English or other majors studying academic English
at a public university in Hanoi. All participants have an English proficiency
equivalent to B1 according to CEFR. The teaching staff is the person conducting the
study.
3. Data The study uses a combination of qualitative and quantitative data, including:
Students' writing before and after implementing the teaching activity based on
Theme–Rheme. A questionnaire collected students’ opinions on their learning
experiences with SFG. Semi-structured focus group interviews with a number of
students (5–7 people) to gain a deeper understanding of their perceptions and
responses. Observational notes from teachers during the teaching process.
4. Implementation process
Week 1: Collect the first writing (pre-test) from students on an academic writing
topic (about 150–200 words).
Weeks 2–3: Teach the theory and implement writing activities using the Theme–
Rheme strategy as described in the pedagogical application section.
Week 4: Collect the writing after the lesson (post-test) and compare it with the first
writing.
Week 5: Distribute the survey and interview a number of students.
Week 6: Analyze the data and draw preliminary conclusions.
5. Data analysis method Analyze the content of the writing: Based on criteria such as
coherence, information organization, and appropriate use of Theme–Rheme.
Descriptive statistics analysis of survey data (percentages, means). Thematic
analysis of interview and classroom observation data, to identify trends in student
perceptions and responses.

IV. Application of SFG in teaching: Specific teaching activities

1. Activity name: Writing academic paragraphs with Theme-Rheme strategy
2. SFG concept taught: Theme/Rheme (Topic - New topic): Students will learn how
to organize information in a way that the topic leads to the new topic, thereby
creating a coherent connection for the text.
3. Target skills: Academic writing skills: Writing paragraphs in academic English
essays, especially at intermediate to advanced levels.
4. Steps to implement the activity:
Step 1 - Introduce the concept: The teacher uses a sample paragraph from an
academic book or a sample essay (IELTS Writing Task 2), analyzing the
Theme/Rheme structure in each sentence.
Step 2 – Analyzing the sample essay: Students work in groups to identify the
"Theme" and "Rheme" in each sentence of the paragraph. The teacher guides them
on how to choose an appropriate topic to ensure coherence and logic.
Step 3 – Writing practice: Students write a paragraph (5-6 sentences) according to
the requirements on a specific topic (Causes of climate change), using the Theme-
Rheme strategy to ensure coherence.
5. Course materials and examples:
Excerpted from Solutions Intermediate or IELTS Writing. For example, students
often write:
“People face many problems. Climate change is one of them. ‘’It caused many
disasters.’’
Students will be guided into:
“Climate change is a major problem that people are facing. It has produced results in
various natural disasters.’’

V. Challenges and solutions

1. Challenges: Teachers are not familiar with SFG: Most EFL teachers in Vietnam
are trained in the traditional grammar direction, lacking knowledge of SFG. Students
may find it complicated and abstract: Approaching terms such as “Theme/Rheme”,
“Transitivity”, “Mood” may be difficult at first. Time and curriculum limitations:
Integrating SFG requires adjustments in lesson plans and teaching time.
2. Solutions: Professional training for teachers: Organize seminars, short courses on
applying SFG in English teaching. Simplify content for learners: Use diagrams,
tables and specific examples that are close to the learning context of students.
Flexible integration into existing lessons: There is no need to replace the entire
method, but short activities based on SFG can be inserted into existing writing,
reading and speaking lessons.
VI. Expected resuts and future research directions
 Expected results: Learners improve their ability to produce academic language,
especially writing and speaking in a more organized and accurate way. Enhance their
ability to analyze language functionally, helping to improve reading comprehension
of specialized texts. Contribute to improving critical thinking and academic
communication. Future research directions: Study the effectiveness of
Theme/Rheme-based writing strategies in improving university students' essays.
Survey the level of acceptance of English teachers in Vietnam for the SFG integrated
teaching method. Design an English teacher training program based on SFG suitable
for the Vietnamese educational context.

VII. Conclusion
Integrating Systemic Functional Grammar (SFG) into teaching English as a foreign
language in Vietnam opens up a new approach, helping learners not only master
grammar knowledge but also understand how to use language in practical academic
and social communication contexts. Through the application of the Theme–Rheme
concept, students can significantly improve their ability to organize information,
enhance coherence and logic in writing, and develop critical thinking and the ability
to use language purposefully. Although there are still challenges in terms of teachers'
expertise, learners' comprehension level and teaching time constraints, solutions
such as short-term training, content simplification, and flexible integration of SFG-
based activities into existing programs are completely feasible and effective. From
the expected results and future research directions, the application of SFG in English
teaching in Vietnam not only has practical value in the classroom, but also
contributes to the process of innovating foreign language teaching methods towards
developing competencies, promoting language thinking and effective
communication in the era of global integration.
 References
Halliday, M. A. K., & Matthiessen, C. M. I. M. (2014). Halliday's introduction to
functional grammar (4th ed.). Routledge.
Martin, J. R., & Rose, D. (2007). Working with discourse: Meaning beyond the
clause. Continuum.
Thompson, G. (2013). Introducing functional grammar (3rd ed.). Routledge.
Nguyen, T. N. M. (2020). Applying systemic functional grammar to teaching
academic writing skills in Vietnam. Journal of Language and Culture Studies,
University of Languages and International Studies.