Skimming

[Russell17au]

THIS IS A WARNING

I am not sure when this happened but on Saturday 26th I received an email from my bank in Australia informing me that my ATM card has been blocked and for me to contact them. My bank in Australia picked up the unusual transaction and blocked my card from further use. It appears that my ATM card was skimmed and a copy made and used to try and purchase things, they did not get my pin number so could not access any ATM's to withdraw cash. There are only 3 ATM's that I use and they are all in busy areas so it is not an out of the way place. I only ever use my card for cash withdrawals and do not use the card for purchases. It is good that the bank security pick this up but it has created another problem for me as now I have no ATM card to be able to access my bank account until a new card arrives from Australia which takes between 7 and 10 working days. I have since opened a Thai bank account.

So my warning is to be very careful at ATM's because there is someone skimming cards, my incident happened in Khon Kaen but they could be anywhere.

Edited May 31, 2018 by Russell17au

[KhunBENQ]

Thanks for the reminder.

It's long since I used a home country card at an ATM here.

And if something is fishy at my Thai accounts I would quickly find out.

Much of the problem lies in the lazy-ness of the banks to finally abolish this antiquated magnetic stripe system.

Chip cards should be harder to skim?

[bluesofa]

9 minutes ago, KhunBENQ said:

Thanks for the reminder.

It's long since I used a home country card at an ATM here.

And if something is fishy at my Thai accounts I would quickly find out.

Much of the problem lies in the lazy-ness of the banks to finally abolish this antiquated magnetic stripe system.

Chip cards should be harder to skim?

Yes, making them harder to skim is the thinking behind the Bank Of Thailand forcing all Thai banks to issue the "chip & pin" cards as they're often to referred in Europe.

The changeover regarding issuing new cards is scheduled to be completed by the end of 2019.

My "Smart Card" has a six-digit pin.

 

Some issues with all retailers being able to accept the new cards for debit/credit card purchases though. A lot of the card machines need upgrading. I know only thorough bitter experience, and contacting the Bank Of Thailand directly to get them to chase the retailer's bank to do the required upgrade to the retailer's card reader machine.

 

[Russell17au]

The new Bank account here in Thailand issued a new "Smart Card" with a 6 number pin, but I do not use my cards for purchases, they only get used to withdraw the cash so it will be interesting when I try to use it in an ATM to see if the bank has updated their ATM's.

[bluesofa]

1 minute ago, Russell17au said:

The new Bank account here in Thailand issued a new "Smart Card" with a 6 number pin, but I do not use my cards for purchases, they only get used to withdraw the cash so it will be interesting when I try to use it in an ATM to see if the bank has updated their ATM's.

FWIW, The Bank Of Thailand told me they have finished upgrading all ATMS, so when a new card with the chip is inserted, it will read the chip details (even though the card still has the magnetic strip on the back.)

 

I know that might seem crazy, but apparently until everyone globally is using the chipped card, the magnetic strip will still be on the card.

From what I've read, I understand the US has only relatively recently started to issue the chip & pin card, it has been reluctant to changeover. It was introduced across Europe in the 1990s.

 

[robblok]

I normally check the ATM to see if the slot where you insert your card is protected. Anyway your skimmers were not really smart normally they have a camera somewhere too to find your ATM code because just copying your card is not really useful.

[theguyfromanotherforum]

You really can't do anything about skimming. I had my card skimmed 3 times in Canada and zero in Thailand.

 

Btw, when these chip and pin cards were introduced in Canada it was a bit of an outrage because suddenly the customers became liable for fraud as the chip and pin cards were supposedly unhackable which is not the case at all.

[poanoi]

i only ever use ATM inside buildings like big C,

less opportunity for thieves to install their scemes

[Russell17au]

It appears that the skimmer that was used was able to read both sides of the card but they were not able to get my pin number so as the bank explained it to me was that they copied the card and used it for doing purchases where the pin number is not required

[Russell17au]

2 minutes ago, poanoi said:

i only ever use ATM inside buildings like big C,

less opportunity for thieves to install their scemes

I only used my card in heavy trafficked areas like at Big C and at the Main Bank branch, but it still got skimmed

[bluesofa]

2 minutes ago, Russell17au said:

It appears that the skimmer that was used was able to read both sides of the card but they were not able to get my pin number so as the bank explained it to me was that they copied the card and used it for doing purchases where the pin number is not required

Again from what I've read about this, within Thailand, the BOT has allowed each retailer themselves to choose the verification method they want to use: PIN, signature, or no verification for transactions below a certain value.

 

To me, it makes it almost pointless having signature verification, as in Thailand I have never, ever, had my signature checked against my card. If the BOT was on the ball, it would force retailers to require a PIN verification. So far, sadly, I have not seem one retailer requesting my PIN for a purchase.

 

When I sign my name, I usually sign 'Enid Blyton' (a UK children's author), just because I can, and to show what a stupid system it is. Twice I have signed as 'Rumpelstiltskin'.

 

[poanoi]

11 minutes ago, Russell17au said:

I only used my card in heavy trafficked areas like at Big C and at the Main Bank branch, but it still got skimmed

but, do you use ATM inside the building that is only open from 10 AM,

or outside the building that is open 24/7 ?

 

for the pin, i cover with my hand when i press the code,

and for online purchase, there is both the 3 number code on the backside

that only the cardholder can know,

and more importantly, at least my card is blocked unless i go into my

bank account and briefly unlock the card for online purchases,

they would have to be online and buy within those few minutes

when i unlock the card to do it

[bluesofa]

25 minutes ago, theguyfromanotherforum said:

You really can't do anything about skimming. I had my card skimmed 3 times in Canada and zero in Thailand.

 

Btw, when these chip and pin cards were introduced in Canada it was a bit of an outrage because suddenly the customers became liable for fraud as the chip and pin cards were supposedly unhackable which is not the case at all.

I haven't seen anything so far about the chip itself being hacked? I'm sure given time it will happen eventually. I would be interested to know if there are any reports about this somewhere?

I wonder if it was the magnetic strip on the card that was hacked, then used in a magnetic strip reader in a reatiler's machine , perhaps?

 

[Russell17au]

1 minute ago, poanoi said:

but, do you use ATM inside the building that is only open from 10 AM,

or outside the building that is open 24/7 ?

 

for the pin, i cover with my hand when i press the code,

and for online purchase, there is both the 3 number code on the backside

that only the cardholder can know,

and more importantly, at least my card is blocked unless i go into my

bank account and briefly unlock the card for online purchases,

they would have to be online and buy within those few minutes

when i unlock the card to do it

Inside the buildings, I normally only go to the ATM once every 2 weeks and withdraw the cash needed for that period so it is normally when I go to Big C, Tesco, or Makro where the ATM's are inside. I cannot go into my bank branch to unlock the card because my bank is in Australia. It appears according to my Australian bank that the skimmer that was used read both sides of the card including the 3 number code on the back. I always cover the keypad with my wallet in my hand and it is easy to feel the keys without seeing them to put your pin number in and that way no one can see the pin number. The inconvenience that this has caused is that I cannot access my Australian bank account until the new card and pin number arrives and the card is activated which hopefully will be soon as I have had to chase around to try and divert money into my new Thai bank account before it goes into my Australian account.

[bluesofa]

1 minute ago, Russell17au said:

Inside the buildings, I normally only go to the ATM once every 2 weeks and withdraw the cash needed for that period so it is normally when I go to Big C, Tesco, or Makro where the ATM's are inside. I cannot go into my bank branch to unlock the card because my bank is in Australia. It appears according to my Australian bank that the skimmer that was used read both sides of the card including the 3 number code on the back. I always cover the keypad with my wallet in my hand and it is easy to feel the keys without seeing them to put your pin number in and that way no one can see the pin number. The inconvenience that this has caused is that I cannot access my Australian bank account until the new card and pin number arrives and the card is activated which hopefully will be soon as I have had to chase around to try and divert money into my new Thai bank account before it goes into my Australian account.

That number is not stored on the card. It is only printed on the back. When used online, after entering the CVV number and the transaction verified, it is compared by your bank, with the three digits they have stored in your account details.

The only way it can be read is optically - either a camera somewhere, or by someone reading it.

 

[poanoi]

3 minutes ago, Russell17au said:

Inside the buildings, I normally only go to the ATM once every 2 weeks and withdraw the cash needed for that period so it is normally when I go to Big C, Tesco, or Makro where the ATM's are inside. I cannot go into my bank branch to unlock the card because my bank is in Australia. It appears according to my Australian bank that the skimmer that was used read both sides of the card including the 3 number code on the back. I always cover the keypad with my wallet in my hand and it is easy to feel the keys without seeing them to put your pin number in and that way no one can see the pin number. The inconvenience that this has caused is that I cannot access my Australian bank account until the new card and pin number arrives and the card is activated which hopefully will be soon as I have had to chase around to try and divert money into my new Thai bank account before it goes into my Australian account.

ah, ok.

the feature my bank has is that if i want to buy anything online,

i have to first login to my bank account using a card-reader and exchange codes

with it and the online banking,

then unlock the automatic block for up to max an hour,

then do the purchase, then return the block, then logout

[55Jay]

All good reminders and tips, good lookin' out, mate.

 

Another tip is to cover the 3 digit CVC code at the back of debit/credit cards, with a piece of colored tape, in the event an attendant takes the card for payment processing, PTT petrol stations, for example.  Sometimes I'll get out and go to the booth myself to sign the slip, just to keep things non-standard. 

[Russell17au]

8 minutes ago, bluesofa said:

That number is not stored on the card. It is only printed on the back. When used online, after entering the CVV number and the transaction verified, it is compared by your bank, with the three digits they have stored in your account details.

The only way it can be read is optically - either a camera somewhere, or by someone reading it.

 

Then that would mean that they have sophisticated enough equipement to get the CVV number but not the pin number, so if it was done with a camera the camera would be facing upward to be able to read the underside of the card but not in a position to pick up the pin number, so maybe they don't want the pin number, maybe they want the details for making payments on purchases online, the bank never told me if it was an online purchase.

[bluesofa]

7 minutes ago, 55Jay said:

All good reminders and tips, good lookin' out, mate.

 

Another tip is to cover the 3 digit CVC code at the back of debit/credit cards, with a piece of colored tape, in the event an attendant takes the card for payment processing, PTT petrol stations, for example.  Sometimes I'll get out and go to the booth myself to sign the slip, just to keep things non-standard. 

That's a very good point, thanks!

I'd missed the obvious there - a crooked sales assistant having the opportunity to read the CVV/CVC number on the card -assuming they're also in a position to skim the card details.

It might be better if the banks issued that number separately, rather than print it on the card, as that is a weakness.

 

[bluesofa]

3 minutes ago, Russell17au said:

Then that would mean that they have sophisticated enough equipement to get the CVV number but not the pin number, so if it was done with a camera the camera would be facing upward to be able to read the underside of the card but not in a position to pick up the pin number, so maybe they don't want the pin number, maybe they want the details for making payments on purchases online, the bank never told me if it was an online purchase.

The skimmers video camera is really pointing at the keypad, in the hope you don't cover the pad when entering your PIN. I wouldn't know if they can read the CVV number easily though.

As 55Jay has just said in post #17, it could possibly be read by a sales assistant.

 

[Russell17au]

4 minutes ago, bluesofa said:

That's a very good point, thanks!

I'd missed the obvious there - a crooked sales assistant having the opportunity to read the CVV/CVC number on the card -assuming they're also in a position to skim the card details.

It might be better if the banks issued that number separately, rather than print it on the card, as that is a weakness.

 

All sales people are in a position that they can skim the cards, they put the card in the reader and they print out 2 slips, 1 for their records and 1 as a receipt for you, that gives them the card number and expiry date, it would not take much to record the CVV number

[Russell17au]

2 minutes ago, bluesofa said:

The skimmers video camera is really pointing at the keypad, in the hope you don't cover the pad when entering your PIN. I wouldn't know if they can read the CVV number easily though.

As 55Jay has just said in post #17, it could possibly be read by a sales assistant.

 

I have never used my card to make any purchases, I only ever use it to withdraw the cash from an ATM

[bluesofa]

Just now, Russell17au said:

All sales people are in a position that they can skim the cards, they put the card in the reader and they print out 2 slips, 1 for their records and 1 as a receipt for you, that gives them the card number and expiry date, it would not take much to record the CVV number

Actually, yes, I've read reports of that having happened in Thailand with two slips, although I'd never thought about them using the CVV number before.

 

[Russell17au]

Over the last 12 months I have only ever used 3 ATM's and those 3 are located inside shopping malls and in a secured area at a bank and that is a worry because where is it safe to use a card now

[Russell17au]

4 minutes ago, bluesofa said:

Actually, yes, I've read reports of that having happened in Thailand with two slips, although I'd never thought about them using the CVV number before.

 

You use your card when you make a purchase anywhere in the world and the machine prints 2 slips, 1 is your receipt of the purchase and your record of the transaction and the other one is the retails copy for their records. If you purchase something online like an airline ticket then you list the card number and the expiry date and the CVV number. So maybe what they are interested in is to use the cards to purchase things online and hope that the bank does not block the transaction before it goes through.

[jaiyen]

Easy problem to solve.  Go in the bank and get cash. Leave it at home and take what you need when you go out. Most people are too lazy to queue in a bank for a few minutes. Many love the plastic technology. Sometimes the old ways are the best !

[worgeordie]

I thought you could get skimmed, if the skimmer got near enough to you

and had the right equipment,so not only at the ATM but could be anywhere,.

regards worgeorie

[scorecard]

16 hours ago, Russell17au said:

I only used my card in heavy trafficked areas like at Big C and at the Main Bank branch, but it still got skimmed

 

Mine got skimmed a few years back at the machine outside of the Thai bank I had been using for years, same branch issued the card. Luckily it was only 4,000Baht, the account did have a much bigger balance. 

 

Local manager told me the bank makes no guarantee that using the ATM is safe from thieves. HO of same bank told me the same thing. 

 

I changed banks and started internet banking, several accounts that don't have ATM cards and I which does have an ATM card.

 

Using internet banking I ensure the available balance in that account is always under 2,000Baht.

 

A bit of a nuisance but worthwhile.

 

 

[bluesofa]

9 minutes ago, worgeordie said:

I thought you could get skimmed, if the skimmer got near enough to you

and had the right equipment,so not only at the ATM but could be anywhere,.

regards worgeorie

That's only if it is a card that supports "contactless" payments, using a technology called nfc, I don't think that's available in Thailand yet.

 

[AlQaholic]

I don't know why they don't abolish the atm and credit cards for good. should be possible to do using the phone and some bank app. SCB at least now has a system in place where you can get money from ATMs using your phone only.