ianguygil

48 minutes ago, topt said:

Thanks for the feedback.

 

I appreciate it is a simple example but Google's PlayStore has had more than a few instances in the past where considerable numbers of certified apps have been found to contain "unexpected" bonus coding ????

 

To be clear my issue is not with the banks but Google locking down more and more a supposedly open system in the name of security which just happens to also protect their revenue stream - just like Apple who however don't try to hide that.

 

Are apps generally more secure than browsers and if so would the banks like to migrate everyone eventually to apps?  

 

 

Yes, DMA's (downloadable mobile applications) are more secure than simple Browser interface, but both can be designed to be secure. It is still acceptable from that standpoint to use Internet Banking and not Mobile Banking.

However, out customer base on Mobile is about 20 times larger than on Internet Banking. It was 10 years ago that Mobile was a subset of Internet in terms of business functionality. Now it is the other way round.

If you root or you jailbreak your phone you effectively have no security. The App Wrapper does many things, protecting from actual attacks but also inspecting the device.

You have the freedom to do whatever you want except to use the services provided by commercial companies if we feel that the risk is not acceptable. For example, the simplest example would be on a keyboard recorder which records everything you type into your phone, emails, messages, PIN's etc. These often can be "hidden" in 3rd party keyboards which are downloaded (actually this is why in the past we shrink wrap the keyboard into the App. 

The whole "freedom" thing seems to be misunderstood, especially in the USA. The 1st Amendment was about the Government, not companies or people. We and all banks have terms of service which clearly setout what is and what is not acceptable behavior. I am not pointing this at you, just saying that in order to protect people and to offer services at an acceptable and controllable level of risk, we need to be able to say when we will and when we will not allow a customer to connect. If we see you coming in from a MAC (Ethernet address) address which has been used for fraud elsewhere similarly we will block you or we will ask for more authentication. This is yet another layer outside of the App Wrapper.

Hope this helps

Honestly this is one of the subjects most recently raised to me, and just yesterday an elderly English man came running out of his home when he saw me walk by and asked me "why now". "Does this mean that some banks will fail soon? ". He has just sold up in the UK and moved over to Hua Hin "permanently". My wife is Japanese and her friends have been contacting me to ask if their retirement funds are "safe". Seems to be a real issue of concern

You guys have all covered this quite well. This was a long time in coming. This was not a recent development brought upon us because of COVID or something else. The deposit insurance was increased during the Financial Crisis 12 or so years ago, in order to ensure we don't have runs on the Banks. It was lowered to 5 million, then it is lowered again now to 1 million per depositor per financial institution. And you have it right in terms of it being limited to that no matter how many accounts you open in a single institution

This is supposed to do a couple of things. Firstly ensure that the insurance is paid for and solvent and will be there when needed. Secondly to introduce more competition into the market, because banks who are viewed as smaller may have to pay higher rates than banks who are better capitalized. 

Now it is really important to note that ALL Thai commercial banks are well capitalized. The BOT are very smart people. All of the major banks sail through stress tests. 

If this is something which will keep you up at night, then the most conservative thing to do is to put your cash into multiple banks as you said. But please remember this insurance only applies to THB savings accounts. Not to Foreign Currency accounts. Not to Mutual Funds and Stocks. If you are really concerned then you can invest in Thai government debt which is backed by the full faith and credit of the people who issue the Baht. 

This is as always purely the information as I have it. It is not official communications from the Bank. It does not constitute investment advice. I have just seen so much concern personally from contacts and particularly from older people who don't have an easy way to earn back any losses, that I thought I would say a few words from my knowledge. But then again, I am a technical propeller head, so what do I know ......

I can't answer anything about other bank apps, but I can answer on Mobile Banking from Bangkok Bank. If you have questions PM me.

Again, the use of SMS (which is the only time we care if you have a Thai phone) is to give us 2 factor authentication for high risk transactions. Things like adding a 3rd party payee. So then the PIN is what you know, Fingerprint or Face is who you are. SIM is what you have. Being as things like FACEID and ANDROID FINGERPRINT are not very robust we tend to rely on SMS still, but that is changing. We use AI products from a global provider to give us digital identity dynamically. We also use a high end App Wrapper to inspect your phone for nasty software. 

So to answer the question, you should be able to setup a phone with a new SIM, a foreign SIM, after you have successfully installed and activated the App on at least 1 device with a Thai SIM. I have many many phones, 2 iOS and many ANDROID, at the moment I use an iPhone Pro Max and a Galaxy S21. I also travel a lot (pre Covid and only sometimes recently) and at times I install a foreign SIM on the phones that already have a the App. It works fine. But if you want to do something that we consider high risk we will ask you to prove what you have, i.e. the Thai SIM for the phone number registered as your "primary". We could care less if you use WIFI or are abroad. That is other banks, not us. But if you are coming in from a location or a device which has been naughty on any online service we will know and we will block you, be it in Thailand or overseas.

PM me if you need to know more about Bangkok Bank. I know nothing and have no opinion about other competitor banks as my official policy so I don't get in trouble. Culturally we will always lean towards the conservative to ensure the security of our customer's accounts, and we will always comply with regulations.

Please PM me if you need more help or explanation. As you can see from my years I am a senior exec at Bangkok Bank

Firstly I need to clarify a few misstatements and and misunderstandings from what I can briefly read here. 

Firstly, the card was not compromised. That would require that the Chip on the card was somehow hacked, and these are special security sealed chips that are tamperproof. 

What does appear to have happened is that the information on the card has leaked out somewhere. Anyone you give your card to, a store, a restaurant, etc. has the opportunity to take a front and back image of the card which includes the CVV - 3 digit code - on the card. This used to be good enough, but in the days of the Internet that is not secure at all

In information security we look for 3 things, 2 of the 3 give you "strong authentication". These are what you know (password, PIN, pass phrase, SSN etc.), what you have (CHIP, SIM, smart card etc.) and what you are (Biometric). In this case someone processed a transaction using just "what you know" which is the card number, expiry date, CVV and possibly the billing address This could've come from a prior transaction and that merchant being hacked. Not the card hacked. Not the Bank hacked

Another concept to get into is "card present" or "card not present". With "card present" you know that somebody had the actual card. That means mainly that the physical card was there and entered into a merchant terminal, or that something like 3DSecure was used. This is where you go to a Bank website and it sends an SMS to you with a One Time Password (OTP) and you enter that at the Merchant site. In this way we have what you know (card number, address, CVV etc) and the OTP which proves "you have" the SIM which is why it comes via SMS. So this is 2-Factor or Strong authentication and becomes equivalent to card present.

The reporting to the Thai police is a legal matter. Same if you lose you passbook which I have done many many times, which is embarrassing to admit. You have to legally report it as a fraudulent transaction. We can and we do block the card. But to refund the transaction we need a police report.

Hope this helps

Ian

I see I am getting a lot of specific questions on our products and services. If you want an answer or help on a specific issue them PM me. I can then get an informed and trained person to answer you. Several TV users have done this just this week. If you have general comments, rants of critiques then it is fine to post them and we will see where we can improve or clarify misunderstandings. But this is not an official "channel" and you would honestly be better by calling 1333, going to a branch or sending an email to [email protected]

Sorry but I honestly do not have time to answer all such questions. I do, however, have time to route your issues to our internal resources, of which there are many. All far better at answering Branch or Product related questions than I

Thanks