Compromised Bangkok Bank Be 1st Debit card

[MajorTom]

Seems at least there is some security now with Thai debit cards. I had a similar experience 10 years ago with a KTB debit card. This was a substantially larger amount, withdrawn in another country while i was in Thailand. (and way over the limit on the card.. how that could happen i never got a good explanation for)

Took me 7 years in court before i was finally reimbursed. Before that i also went through police reports, consumer protection agency, lawyers++. Bank simply refused any responsibility.

[thonglorjimmy]

9 hours ago, SAFETY FIRST said:

Please explain what procedure others should follow if we become victims.
Do we need to file a police report? 

As I said previously, I called the bank and they required that I file a police report, though admitted the police wouldn't be interested and certainly wouldn't take any action.

 

As I also said, the police suggested that the bank insist on a police report with the expectation that many people wouldn't bother, I don't know if that's the case or it's because those who were trying to con the bank would be less inclined to file a report. 

[SAFETY FIRST]

24 minutes ago, thonglorjimmy said:

As I said previously, I called the bank and they required that I file a police report, though admitted the police wouldn't be interested and certainly wouldn't take any action.

 

As I also said, the police suggested that the bank insist on a police report with the expectation that many people wouldn't bother, I don't know if that's the case or it's because those who were trying to con the bank would be less inclined to file a report. 

Yes, you did say that but was it necessary. 

K. I. S. 

I had an issue with Kasikorn, I filled out a report with customer service, after a few weeks my money was fully refunded. No police report. 

 

[SAFETY FIRST]

On 7/29/2021 at 5:21 PM, SAFETY FIRST said:

On 7/29/2021 at 4:52 PM, thonglorjimmy said:

As I said previously, I called the bank and they required that I file a police report, though admitted the police wouldn't be interested and certainly wouldn't take any action.

 

As I also said, the police suggested that the bank insist on a police report with the expectation that many people wouldn't bother, I don't know if that's the case or it's because those who were trying to con the bank would be less inclined to file a report. 

Expand  

Yes, you did say that but was it necessary. 

K. I. S. 

I had an issue with Kasikorn, I filled out a report with customer service, after a few weeks my money was fully refunded. No police report

I reckon your bank has given you the wrong information. 

Its always a good idea to go into your branch personally, these telephone helpline people are useless. 

[Etaoin Shrdlu]

Further to my July 20 post, I can now report that SCB returned the funds to my son's account last week. It took about three weeks to get the money back. No police report was required.

[ianguygil]

Please PM me if you need more help or explanation. As you can see from my years I am a senior exec at Bangkok Bank

 

Firstly I need to clarify a few misstatements and and misunderstandings from what I can briefly read here. 

 

Firstly, the card was not compromised. That would require that the Chip on the card was somehow hacked, and these are special security sealed chips that are tamperproof. 

 

What does appear to have happened is that the information on the card has leaked out somewhere. Anyone you give your card to, a store, a restaurant, etc. has the opportunity to take a front and back image of the card which includes the CVV - 3 digit code - on the card. This used to be good enough, but in the days of the Internet that is not secure at all

 

In information security we look for 3 things, 2 of the 3 give you "strong authentication". These are what you know (password, PIN, pass phrase, SSN etc.), what you have (CHIP, SIM, smart card etc.) and what you are (Biometric). In this case someone processed a transaction using just "what you know" which is the card number, expiry date, CVV and possibly the billing address This could've come from a prior transaction and that merchant being hacked. Not the card hacked. Not the Bank hacked

 

Another concept to get into is "card present" or "card not present". With "card present" you know that somebody had the actual card. That means mainly that the physical card was there and entered into a merchant terminal, or that something like 3DSecure was used. This is where you go to a Bank website and it sends an SMS to you with a One Time Password (OTP) and you enter that at the Merchant site. In this way we have what you know (card number, address, CVV etc) and the OTP which proves "you have" the SIM which is why it comes via SMS. So this is 2-Factor or Strong authentication and becomes equivalent to card present.

 

The reporting to the Thai police is a legal matter. Same if you lose you passbook which I have done many many times, which is embarrassing to admit. You have to legally report it as a fraudulent transaction. We can and we do block the card. But to refund the transaction we need a police report.

 

Hope this helps

 

Ian