What sits inside an F88 Online loan account, and the authorized way to reach it

A live F88 Online account carries a repayment schedule — due date, principal portion, interest, and two service fees — for every active loan a borrower holds against a vehicle registration. That schedule, the running payoff balance, and the disbursement history are the records a lender, an aggregator, or a debt-servicing partner actually needs, and they sit behind a personal login rather than in any public feed. This brief maps those surfaces for the F88 Online app (package vn.digital.digitalonline, per its Play Store listing) and sets out the authorized way we reach them.

F88 lends against motorbike and car registration papers, with amounts the listing puts from 3 million up to 2 billion VND over terms of 3 to 18 months, and disbursement by cash or bank transfer. The bottom line for an integrator: the valuable state is per-contract and changes monthly as payments post, so the connection has to track a schedule, not just snapshot a balance. We would build it on the borrower's own consent to their account, using authorized analysis of the app's traffic — described below.

Borrower records the app holds

Each row reflects a surface the app exposes to its own signed-in user. Field names follow how F88 frames them in Vietnamese where that matters.

How the data is reached

Three routes genuinely fit F88. They are not equal, and the recommendation follows.

Consent-based interface analysis (the one we would build)

The borrower authorizes access to their own F88 account; we analyze the app-to-server traffic that already serves the loan list and amortization view, then implement a clean client against those endpoints. This reaches everything in the table above because it is exactly what the app itself renders. Effort is moderate — most of it is mapping the login and token flow and the per-contract calls. Durability is good month to month, with a re-check needed when F88 ships a front-end change. We arrange the test account and the authorization with you during onboarding.

Bank Open API (for the transfer leg only)

Where a loan was disbursed or repaid by bank transfer, that movement also lives at the borrower's bank, reachable under Circular 64/2024/TT-NHNN as the State Bank of Vietnam phases consented customer-information APIs in. This does not return F88 contract terms — it corroborates the cash movement, and only for the bank that holds the account. Useful as corroboration, narrow in scope.

Native export

Contracts and quotes that F88 issues as documents can be ingested where a borrower can produce them, which is handy for a one-off pull or as a verification check against the live feed. It is not a substitute for an ongoing schedule sync.

For a working, repeatable connection the consent-based interface route is the one to build; the bank leg is worth adding only when a customer specifically needs the transfer side verified, and export stays a useful cross-check rather than a feed.

A repayment-schedule query, sketched

Illustrative shape of the call sequence — exact endpoints and field names are confirmed during the build against a consenting account.

POST /auth/login            # phone + credential -> session
  -> { "access_token": "...", "refresh_token": "...", "expires_in": 3600 }

GET  /loans?status=active   # Authorization: Bearer <access_token>
  -> [ { "contract_id": "F88-...", "package": "uu_dai_dung_han",
         "principal_vnd": 20000000, "term_months": 12,
         "repayment_type": "level_monthly" } ]

GET  /loans/{contract_id}/schedule
  -> { "apr_flat_pct": 24.6,                 # max flat rate per listing
       "installments": [
         { "due": "2026-07-15", "principal_vnd": 1666667,
           "interest_vnd": 246000, "mgmt_fee_vnd": 90000,
           "asset_fee_vnd": 73000, "status": "due" } ] }

# handle 401 -> refresh once via /auth/refresh; on repeat 401 stop and
# flag for re-consent. retry network 5xx with backoff, never on 4xx.

Two amortization shapes have to be honored: level monthly principal-plus-cost, and cost-only each month with principal at term end. The schedule endpoint resolves which applies from the contract's repayment_type.

What lands at the end

The output is a working connection plus the documents to run and maintain it, all scoped to F88's real surfaces:

• An OpenAPI/Swagger specification covering the login, loan list, contract detail and schedule calls.
• A protocol and auth-flow report: the token issue-and-refresh chain, session handling, and the error and re-consent paths.
• Runnable source for the key endpoints in Python or Node.js, with a normalized schema that turns Vietnamese fields and VND amounts into stable keys.
• Automated tests against the loan-list and schedule responses, including the two repayment shapes and the 401-refresh path.
• Interface documentation, plus consent-logging and data-retention guidance aligned to Vietnamese law.

Consent and the legal frame

F88 holds sensitive financial and identity records, so access rests on the borrower's explicit consent to their own account. Vietnam's Law on Personal Data Protection (Law 91/2025/QH15) took effect on 1 January 2026, replacing Decree 13/2023; per legal summaries we reviewed it keeps a consent-centric model — consent must be specific and recorded, and the data subject can access, withdraw and request deletion. We act on that directly: access is scoped to the named loan fields rather than the whole account, consent and access events are logged, stored data is minimized, and a withdrawal stops the sync without leaving orphaned copies. An NDA covers the engagement where the client needs one. F88 itself is a non-bank lender, so its loan terms are not published through a bank Open API catalog; the borrower's authorization is the basis, not a vendor data programme.

Build notes specific to F88

Two things about this app shape the work, and we handle both:

• Package-specific economics. F88 runs several loan packages — general, plus preferential ones for early-payoff penalty, office staff, on-time payers and women in business — and each sets its own loan-management fee, asset-management fee and flat interest. We map the package rules so the schedule endpoint returns the right figures per contract instead of one averaged curve.
• Offline events in a branch-heavy network. F88 pairs the app with a large physical store network across Vietnam, and disburses by cash as well as transfer, so some contract activity originates at a counter. We design the sync to reconcile app-visible state against the disbursement channel so cash and transfer payouts both land as clean events.
• Front-end drift. A consumer app's screens change. We build a re-validation step into maintenance so a layout or endpoint change is caught and patched before it breaks a borrower's schedule pull.

Access, a test account and any authorization paperwork are arranged with you as part of onboarding — they are steps in the project, not a checklist to clear first.

Pricing

Source-code delivery starts at $300, and you pay only after the working F88 Online connection is in your hands and you are satisfied with it — you get the runnable source, the spec, the tests and the interface docs to own outright. The alternative is the pay-per-call hosted API: we host the connection, you call our endpoints and pay per call, with no upfront fee. Either way the build runs on a 1–2 week cycle. Tell us the data you need from F88 and which model suits you on the contact page and we will scope it.

Freshness and reliability

Because balances move only as monthly installments post, a daily sync is usually ample, with an on-demand refresh for payoff quotes where a borrower asks for a settlement figure. Token lifetimes are short, so the client refreshes silently and only surfaces a re-consent prompt when a refresh genuinely fails. The re-validation step keeps the connection honest when F88 updates the app.

Interface evidence

App screens from the store listing, useful for confirming which surfaces a build targets.

How this was checked

Mapping done on 28 June 2026 by the OpenBanking Studio integration desk. We read F88's own store listing for the loan amounts, terms, package set, fee structure and the flat APR figure; pulled company and funding context from Vietnamese business press; and confirmed the regulatory frame against legal summaries of Circular 64 and Vietnam's data-protection law.

• F88 Online — Google Play listing
• VnExpress — F88 raises $50M (company context)
• Tilleke & Gibbins — Open APIs in Vietnam (Circular 64)
• Hogan Lovells — Vietnam's Law on Personal Data Protection

Similar apps in the same data space

Lenders and wallets an integrator often connects alongside F88, each holding comparable per-user financial records that fold into one unified interface.

• FE Credit (FE ONLINE) — consumer finance app with loan accounts and repayment schedules.
• Home Credit Vietnam — installment loans and point-of-sale finance with per-contract state.
• Timo — digital bank with accounts, transfers and installment loans.
• MoMo — wallet super-app offering small loans and pay-later through partner banks.
• ZaloPay — wallet with payment history and credit features.
• Viettel Money — mobile-money service with balances and transaction records.
• Cake by VPBank — digital bank holding accounts and credit data.
• Vietdong — short-term online lender with loan and tenor records.

Questions integrators ask

Does Vietnam's open-banking Circular 64 cover an F88 Online connection?

Circular 64/2024/TT-NHNN governs Open APIs that commercial banks publish; F88 is a non-bank secured lender, so its borrower data does not arrive through a bank Open API catalog. The dependable basis is the borrower's own consent to access their account, with the integration built by authorized interface analysis of the app's own traffic. Where a loan was funded by bank transfer, the bank leg can later be reached through Circular 64 once that phase is live.

Can each F88 Online loan package be read with its own fee schedule?

Yes. F88 lists several packages — a general package plus preferential ones for early-payoff penalty, office workers, on-time payers and women in business, per its store listing. Each carries its own loan-management fee, asset-management fee and flat interest, and two repayment shapes (level monthly principal-plus-cost, or cost-only with principal at term end). We model the package and the repayment shape so a single schedule endpoint returns figures that match the signed contract.

How is borrower consent handled under Vietnamese data law?

Vietnam's Law on Personal Data Protection (Law 91/2025/QH15, in force 1 January 2026, replacing Decree 13/2023) requires consent that is specific, recorded and revocable, and recognizes the borrower's rights to access, withdraw and request deletion. We scope access to the named loan fields, keep consent and access logs, minimize what is stored, and design revocation to stop the sync cleanly.

How do cash disbursements show up versus bank-transfer ones?

F88 disburses by cash at a branch or by bank transfer, and runs a large physical network alongside the app, so some contract events originate offline. We reconcile app-visible state against the disbursement channel so a cash payout and a transfer payout both land as clean events in the normalized schema rather than appearing as gaps.