Compromised Bangkok Bank Be 1st Debit card

[thonglorjimmy]

I opened a Bangkok Bank Savings account two years ago, for the sole intention of receiving funds via Transferwise, as was, with the appropriate coding to satisfy Immigration Officers whims.

 

I got one of their Mastercards when I opened the account, just in case, the card has been sitting in a draw for two years and has never been used, or even left the draw.

 

Yesterday I received an SMS message confirmg a transaction of 2,000.59 Baht to a company via an EDC Terminal, I've never heard of the company who Mr Google says offers a service checking grammar on documents, not a service I'd consider paying for, and I've certainly never given my card details to this, or any other company. 

 

I called Bangkok Bank yesterday and after going through a miriad of security questions she recorded my complaint and asked me if I wanted to suspend the card, which she did and confirmed so, she advised that it would be sent to the appropriate department, who would be in touch.

 

This morning I received an email from Customer Services regarding my "query" and saying that if I disputed a transactions I should contact 1333, which I did, cancel the card, which I did, and file a police report, which wasn't mentioned yesterday, but which I have no problam doing even though it seems like overkill, then they will pass it on to the fraud department, which they promised to do yesterday.

 

I'm assuming this is a bog standard automated response, but I wonder if any of you have encountered this sort of issue, and if so how did it pan out? 

[worgeordie]

You should never carry a large deposit in any account

connected to a debit card, bit to late for you, but might

help others.

Hope you manage to get the problem resolved.

regards worgeordie

[thonglorjimmy]

55 minutes ago, worgeordie said:

You should never carry a large deposit in any account

connected to a debit card, bit to late for you, but might

help others.

Hope you manage to get the problem resolved.

regards worgeordie

Thanks

 

Thankfully I only use that account to receive transfers from Wise and then transfer funds to my regular account, there's only about 20,000 Baht in there, or at least there was.

 

Still intrigued as to how it happened. 

[KhunBENQ]

1 hour ago, thonglorjimmy said:

EDC Terminal

That's not a company. It stands for a method of payment.

Doesn't say for what purpose.

For me it appears for certain online payments.

You did never hand out the card at some shop/fuel stop or the like?

The three digit security code on the back is readable? (I note it and scratch it off).

Quote

Purchase via EDC

2,400.00

This e.g. was for my deposit payment for some vaccination at private hospital.

Paid online like a credit card transaction.

 

Edited July 18, 2021 by KhunBENQ

[thonglorjimmy]

1 minute ago, KhunBENQ said:

That's not a company. It stands for a method of payment.

Doesn't say for what purpose.

For me it appears for certain online payments.

You did never hand out the card at some shop/fuel stop or the like?

The three digit security code on the back is readable? (I note it and scratch it off).

Yes I realise that paying to a company via an EDC Terminal doesn't mean that EDC is a company, it's a payment route.

 

As I said the card has never left my drawer and I've never used it online.

 

curiouser and curiouser

[Thomas J]

1 hour ago, thonglorjimmy said:

I called Bangkok Bank yesterday and after going through a miriad of security questions she recorded my complaint and asked me if I wanted to suspend the card, which she did and confirmed so, she advised that it would be sent to the appropriate department, who would be in touch.

It sounds to me that either Bangkok Bank was hacked or that someone using a random number generator somehow created your number.   The bank will  be able to determine if it was a card presented or internet based transaction.  If it was a card presented transaction someone with the skill to take the information and encode it on a card is involved and that would likely be from someone who hacked into Bangkok Bank.  There are card "skimmers"  If you go to a restaurant, bar, dept. store etc and use the card, accomplishes run your card through a reader that captures all of the information and they then use that to create a cloned card or to do internet purchases.  The fact that the product or service was going to a different person and/or address than yours should serve as proof it was not you.  That being said, it is up to the bank to determine it to be fraudulent and reimburse you. 

[KhunBENQ]

57 minutes ago, thonglorjimmy said:

Yes I realise that paying to a company via an EDC Terminal doesn't mean that EDC is a company, it's a payment route.

Sorry, got your post wrong.

[OneMoreFarang]

2 hours ago, thonglorjimmy said:

As I said the card has never left my drawer and I've never used it online.

Unfortunately that brings up the question: Who has or ever had access to that drawer? 

 

I find it always annoying when some technicians, i.e. the guys to clean the aircon, come to my apartment. It doesn't matter if there is a document on a desk or an electronic part or a box or whatever. At least one person of that team always decides he has to take some things in his fingers and look at it, play with it, or whatever. That seems to be Thai nature. And maybe some people go a step further and open drawers... 

[GregTN]

I had a very similar thing happen to me a couple of months ago with a BB VISA debit card.  Like yourself I never used the card and it was locked up in a small safe.  I only carried the card with me when we traveled as a backup for my credit card but it was never needed.  We made a withdrawal  at the bank and noticed two transactions, one for 3000 and one 3500 baht and found out through the bank they where made the day before and it was a charge for Google Trans Q, whatever that is.  

We were instructed to contact the card company and report the transactions and cancel the card.  We were asked to do a police report and fax it back to them and they would investigate the claim and contact us in 4-6 weeks.  After reading the debit card policy that was written in Thai my wife explained to me that basically the card holder is ultimately responsible for all charges made on the card so at that time I considered that money gone and thankful it was not a lot more.  To my surprise approximately 5 weeks later we received a letter from BB stating the money has been credited back to our account without any other explanation.

I was fortunate to catch the issue early and as suggested above, never attach a debit card to an account with a high balance in it.  I would like to add that BB and the card department were very professional and handled everything very well.

[Knocker33]

Same happened to me last year. Two transactions to PayPal. Had the run around for a while . Then had an email telling me to get a police report and send to them. Took a couple of months but got money back.

[Etaoin Shrdlu]

The same thing happened to my son a couple of weeks ago. We were sitting together talking when his phone buzzed four times in fairly quick succession. He had received four SMS messages advising of debit card transactions totaling about thb25,000. He immediately called SCB to report the fraud and cancel the card. SCB took the info, but did not request a police report. He was told that SCB would investigate and get back to him within two months. The transactions were for rather odd amounts in Thai baht, but when converted to Euros they came very close to rounding to the nearest 100. Our suspicion is that the fraud was perpetrated in Europe, or at least the original currency they were debited in was Euros.

Edited July 20, 2021 by Etaoin Shrdlu
typo

[thonglorjimmy]

Thanks for the comments.

 

A fair point about somebody having access to the draw in my desk, the only two who could have been near there were my wife and possibly the cleaner. I don't suspect my wife at all, she has more money than me and certainly wouldn't need to access this account for the sake of 2,000 Baht, ignoring the other cards. Likewise the cleaner, even if she'd had a good root round and found the card, I really couldn't see her ignoring the higher value cards, belonging to my wife and I to send 2,000 Baht to "Grammarly.co".

 

The bank insisted on a police report, conceeding that the police wouldn't be interested and wouldn't take any action. The police officer suggested that the bank probably wanted a report in the full knowledge that most people wouldn't bother, and it would save them the hassle, they however provided the report the bank required.

 

I won't bother replacing the card, if I need to withdraw cash I'll use the app on the phone, and I never use this card for online pruchases.

 

The banks fraud department have opened my response, I'll just have to wait and see now. 

[SCOTT FITZGERSLD]

first, thanks for letting us know. it is important to learn about banking problems.

 

i did dispute few payments in the past in my hong kong bank. their service was very good,

efficient and clear. only had to fill one form to explain my case. refunds came aventually

and they were even kind enough to reverse exchange differences.

 

iallways wondered how it would be done in thailand and your post confirm the worst.

it is not your duty to go to the police. the bank should do it and the bank should

refund your money after contacting the suspicious company.

 

what you had to do first, was to call that company and ask them who the hell are they and

why did they charge your card and how they got your details,

[soisanuk]

On 7/18/2021 at 2:47 PM, OneMoreFarang said:

Unfortunately that brings up the question: Who has or ever had access to that drawer? 

 

I find it always annoying when some technicians, i.e. the guys to clean the aircon, come to my apartment. It doesn't matter if there is a document on a desk or an electronic part or a box or whatever. At least one person of that team always decides he has to take some things in his fingers and look at it, play with it, or whatever. That seems to be Thai nature. And maybe some people go a step further and open drawers... 

This is the reason I stay in the room where they are working. I keep any valuable items in the safe or in a lockable drawer.

[SAFETY FIRST]

On 7/18/2021 at 10:10 AM, worgeordie said:

You should never carry a large deposit in any account

It was 2000.59 Baht. 

Its not a large amount of money. 

 

[flossie35]

I also have a Bangkok Bank card. Limit 10,000. A year or two ago someone used it to pay a small sum to the London Borough of Barking, and a larger sum to pay a telephone bill. I have never used the card in the UK, and have no connections at all with Barking, and no idea how someone in Barking could use a Thai card to which they had no access except by hacking my computer I suppose. I reported to the Bank who promised to investigate, which they did, and they refunded the money. Whoever had used the card left a trail that Clouseau could have followed, and was presumably caught.  

[worgeordie]

1 hour ago, SAFETY FIRST said:

It was 2000.59 Baht. 

Its not a large amount of money. 

 

But what I say still stands , there was a poster asking

yesterday how to move his 800,000 thb account for

retirement extension to account without been tied to debit card.!

 

Maybe the 2000 Thb was a trial run and they would have been

back for more, if you had more in the account, good job you

canceled the card quickly.

Regards Worgeordie

[The Hammer2021]

24 minutes ago, worgeordie said:

But what I say still stands , there was a poster asking

yesterday how to move his 800,000 thb account for

retirement extension to account without been tied to debit card.!

 

Maybe the 2000 Thb was a trial run and they would have been

back for more, if you had more in the account, good job you

canceled the card quickly.

Regards Worgeordie

There is usually a limit on how much can be withdrawn

[scorecard]

On 7/18/2021 at 1:10 PM, worgeordie said:

You should never carry a large deposit in any account

connected to a debit card, bit to late for you, but might

help others.

Hope you manage to get the problem resolved.

regards worgeordie

Well said. A year back I did an online transfer of AU$2,000- from my main savings account to my Debit card. Within seconds I got a call from my very security focused OZ bank pointing out that criminal misuse of debit cards is very common.

 

I explained I had done the transfer deliberately anticipating to make a large online purchase within the next few minutes.

 

Response from bank 'we can monitor the debit card say for five minutes or whatever and automatically transfer the large amount back to your savings account if there's no transaction, if you wish'. I agreed to a 10 minute monitoring.

 

On further review of the product I decided not to buy.

 

Sure enough (I timed it) at exactly 10 minutes the funds disappeared from my debit card and instantly reappeared in my main savings account.

 

Same bank officer immediately called to confirm if was aware the funds had gone back to my main savings account and he politely spoke again about the dangers of debit cards. I thanked him.

 

Great service, and it made me more aware of keeping only very minimal funds in my debit card.

 

 

[scorecard]

2 hours ago, flossie35 said:

I also have a Bangkok Bank card. Limit 10,000. A year or two ago someone used it to pay a small sum to the London Borough of Barking, and a larger sum to pay a telephone bill. I have never used the card in the UK, and have no connections at all with Barking, and no idea how someone in Barking could use a Thai card to which they had no access except by hacking my computer I suppose. I reported to the Bank who promised to investigate, which they did, and they refunded the money. Whoever had used the card left a trail that Clouseau could have followed, and was presumably caught.  

Same, several years ago. Same day, 3 transactions on my card (issued in cooperation with Mastercard) at a large supermarket, total around US$500. And same at 2 more large supermarkets (each a total around US$500). Total US$1,500-. 

 

All transactions on the same day within one hour and across 3 different countries none close to each other, and no country near my country of domicile. I went straight to my bank branch, the m'ngr took copies of every page of my passport to prove no travel. All investigated quickly and charges cancelled. 

 

Another point, HO of my bank quickly got involved, called me to ask for a lot more details. Bank guy also asked 'do you want an instant SMS message wherever your card is used anywhere in the world?' I confirmed yes and got a quick confirmation the service had been started.

 

Bank guy also mentioned 'please react very quickly if you get an SMS which makes you suspicious'. He also courteously mentioned 'if this happens 2 more times you will automatically be suspected of collusion'. 

 

 

 

[Sydebolle]

There is a simple trick to all this. Have TWO accounts even at different banks. 

Bank AAA with the money on it without ATM or any other card and mandatory OTP approval for any amount
Bank BBB with a minimum balance to keep the account running and an ATM card and a spending limit to your liking. 

Now, if you need to withdraw money, move the respective amount from AAA to BBB (no longer any fees applicable) and approve that transfer with a OTP sent to your phone. Then withdraw the amount in question from BBB with the ATM card. 

Sounds a little complicated and requires that you have to open two bank accounts (can also be the same bank and/or even same branch) but impossible to steal any money electronically. 

Had a problem many many moons ago with Thai Farmers bank at the time which never got solved; ever since applied the above system, meanwhile with two different banks and never ever had a problem ever again ???? 

[The Theory]

On 7/18/2021 at 12:01 PM, thonglorjimmy said:

As I said the card has never left my drawer and I've never used it online.

Taking photos of both sides would work well. 

[fulhamboy]

My Nationwide credit card was used by a Random card generator,

Which they used for small amounts, printer cartridges etc, which 

They probably used for their print outs !

[BusyB]

On 7/18/2021 at 6:54 AM, KhunBENQ said:

That's not a company. It stands for a method of payment.

Doesn't say for what purpose.

For me it appears for certain online payments.

You did never hand out the card at some shop/fuel stop or the like?

The three digit security code on the back is readable? (I note it and scratch it off).

This e.g. was for my deposit payment for some vaccination at private hospital.

Paid online like a credit card transaction.

 

(I note it and scratch it off).

 

Thanks, I'm pretty security conscious but never thought of that ????

[chilly07]

Yes having read the posts I checked my Mbanking with BB and although I always transfer funds to another account for day to day use I see that you cannot freeze your debit card on line as I can with other banks and cards.

But you can set all transaction limits to zero which has the same effect and then set it back when you need to use it.

[JimGant]

On 7/18/2021 at 12:05 PM, Thomas J said:

If it was a card presented transaction someone with the skill to take the information and encode it on a card is involved and that would likely be from someone who hacked into Bangkok Bank. 

Last I read, chips can't be duplicated by hackers on credit/debit cards. Thus, absent a card lost or stolen, the only fraud available is with "card not present" transactions, i.e., mainly on the internet -- and these usually require a CVV numbe. So, obliterate your CVV number on the back of your card so when your card disappears into the bowels of the restaurant, no one is copying your CVV number. This obliterated number in no way affects any "card present" transactions; should the merchant ask for it, he's a crook.

 

 

[Thomas J]

12 minutes ago, JimGant said:

Last I read, chips can't be duplicated by hackers on credit/debit cards

Yes, I understand that the chips can not be duplicated.  However the majority of fraud is from card not present transactions and some merchants still don't have the chip enabled readers and rely on the magnetic stripe.  The information on the magnetic stripe includes all the information necessary to produce a cloned card with a magnetic strip.  However if they are using the card over the internet they would only need the card number, name, and CCV number which they can get from skimming or shimming the card. 

That is why so many cards these days even chipped cards have merchant systems that require a one time code in order to accept the transaction.  Though possible, it is more likely that the person doing the fraudulent transaction would not have your phone to get the one time code.  And if they did have your phone, they would not have your pin number to open your phone to get the code 

 

[thonglorjimmy]

The debit was refunded yesterday without explanation, of course pleased to get the cash back but it would have been nice to have known what happened.

[SAFETY FIRST]

14 hours ago, thonglorjimmy said:

The debit was refunded yesterday without explanation, of course pleased to get the cash back but it would have been nice to have known what happened.

That's good news.
Please explain what procedure others should follow if we become victims.
Do we need to file a police report? 

[kralledr]

On 7/18/2021 at 11:54 AM, KhunBENQ said:

That's not a company. It stands for a method of payment.

Doesn't say for what purpose.

For me it appears for certain online payments.

You did never hand out the card at some shop/fuel stop or the like?

The three digit security code on the back is readable? (I note it and scratch it off).

This e.g. was for my deposit payment for some vaccination at private hospital.

Paid online like a credit card transaction.

 

I am merchant myself, and we have a few EDC terminals. and even some portable ones, that we can take around thailand, we can charge any card and NOT need the security code, if it's not over 20k...