Could this happen in Thailand? phone & card theft leading to theft from bank account

[scubascuba3]

Worth reading this, i thought this wasn't possible

 

BBC News - How is a thief taking thousands from London gym-goers?

https://www.bbc.co.uk/news/uk-england-london-62809151

[Stocky]

I don't think they can use this method with Thailand banks.

 

UK banks issue you with card and PIN, posted separately, there is no option to change the PIN at the ATM. Thai ATM PIN numbers are registered on the card when you activate a new card at the bank, you enter your own PIN, you can also change your PIN at the ATM. Thai banking apps don't have the same option UK banks have to send a PIN reminder. 

 

But it's worth taking the advice given in that article and disable notifications on the lock screen.

[scubascuba3]

4 minutes ago, Stocky said:

I don't think they can use this method with Thailand banks.

 

UK banks issue you with card and PIN, posted separately, there is no option to change the PIN at the ATM. Thai ATM PIN numbers are registered on the card when you activate a new card at the bank, you enter your own PIN, you can also change your PIN at the ATM. Thai banking apps don't have the same option UK banks have to send a PIN reminder. 

 

But it's worth taking the advice given in that article and disable notifications on the lock screen.

But could someone with your stolen phone and card, maybe bank book, install the bank app on the new phone, so resetting it up, will probably send an OTP to the new phone using the sim from stolen phone

[KannikaP]

8 minutes ago, Stocky said:

UK banks issue you with card and PIN, posted separately, there is no option to change the PIN at the ATM

Oh yes there is, and it is possibly the only option.

[1FinickyOne]

11 minutes ago, scubascuba3 said:

But could someone with your stolen phone and card, maybe bank book, install the bank app on the new phone, so resetting it up, will probably send an OTP to the new phone using the sim from stolen phone

or is it just easier to rob a bank? 

[The Fugitive]

24 minutes ago, KannikaP said:

Oh yes there is, and it is possibly the only option.

Agree. I've done it myself several times in the last few weeks.

[scubascuba3]

17 minutes ago, 1FinickyOne said:

or is it just easier to rob a bank? 

no that's far worse, armed robbery big prison sentence. Fraud nothing 

[The Fugitive]

Good advice and instructions in the newspaper article about why and how to change your notification settings for iPhones and Android. Must admit, both my main 'phone and back-up were set to always show notifications whether locked or not. Another lesson learned thank you! 

[steven100]

20 minutes ago, The Fugitive said:

Good advice and instructions in the newspaper article about why and how to change your notification settings for iPhones and Android. Must admit, both my main 'phone and back-up were set to always show notifications whether locked or not. Another lesson learned thank you! 

so should withdrawal or transfer notifications only show when you open your mobile ?  ( after entering your pin)  

[Stocky]

1 hour ago, KannikaP said:

Oh yes there is, and it is possibly the only option.

Thanks for the correction, I hadn't realised I could now change my PIN at the ATM in the UK. Though the point about PIN reminders, I can't find any option in either the KBank or Krungsri banking apps that lets me request a PIN reminder. 

 

[scubascuba3]

30 minutes ago, The Fugitive said:

Good advice and instructions in the newspaper article about why and how to change your notification settings for iPhones and Android. Must admit, both my main 'phone and back-up were set to always show notifications whether locked or not. Another lesson learned thank you! 

but if the thief takes the sim out and puts in new phone he'll receive the otp code?

[KannikaP]

7 minutes ago, Stocky said:

Thanks for the correction, I hadn't realised I could now change my PIN at the ATM in the UK. Though the point about PIN reminders, I can't find any option in either the KBank or Krungsri banking apps that lets me request a PIN reminder. 

 

use the same one for everything

[The Fugitive]

11 minutes ago, steven100 said:

so should withdrawal or transfer notifications only show when you open your mobile ?  ( after entering your pin)  

I expect so because the setting refers to all notifications. Will observe what happens from now onwards!

[Stocky]

Just now, KannikaP said:

use the same one for everything

Maybe not such a good idea. I have different PINs for each of my cards.

[scubascuba3]

15 minutes ago, steven100 said:

so should withdrawal or transfer notifications only show when you open your mobile ?  ( after entering your pin)  

it's any notifications but it seems the idea is stop OTPs being seen

[scubascuba3]

There was a thread about this in the last 2 weeks in Thailand where a guy got his phone stolen and money transferred, same as op story, most people thought he was lying

[The Fugitive]

6 minutes ago, scubascuba3 said:

but if the thief takes the sim out and puts in new phone he'll receive the otp code?

Didn't think of that. Head scratching time now!

[steven100]

3 minutes ago, Stocky said:

Maybe not such a good idea. I have different PINs for each of my cards.

I can't remember how many bottles I had yesterday afternoon so how can I remember different PIN's for everything

[Stocky]

37 minutes ago, scubascuba3 said:

There was a thread about this in the last 2 weeks in Thailand where a guy got his phone stolen and money transferred, same as op story, most people thought he was lying

There was one about money lost from a Thai bank account recently. Guy lost his phone in a bar, but his password was date of birth, which isn't too bright. Also it wasn't his first time losing things, so wasn't surprised the bank weren't interested in giving him a refund.

 

But there was a second thread, maybe a month ago, with someone losing money from a Santander account having lost his phone and cards(?) which sounds very similar. Santander were had little sympathy, much like Charlotte's case in the original article, which was also Santander. 

 

.

[KhunBENQ]

As I understand the described method would result in registering the banking app to a new phone (and phone number).

 

1) As far as I know there is no way to change the phone number for receiving OTP (one time pins for transactions) other than visiting a branch with your ID.

So simply transferring to another phone nr? No.

 

2) I am not aware that you could use the banking app without knowing the login pin (or fingerprint) and this is not stored on/sent to the phone

 

3) my phone is always locked, at least requires a pin/password/fingerprint or whatever to unlock. I would also power it off if I am forced to put in a locker or safe.

 

And wouldn't it be safer to have the phone with me at a gym, placed near me in a bag or so than in such an easy accessible locker?

 

[scubascuba3]

6 minutes ago, KhunBENQ said:

As I understand the described method would result in registering the banking app to a new phone (and phone number).

 

1) As far as I know there is no way to change the phone number for receiving OTP (one time pins for transactions) other than visiting a branch with your ID.

So simply transferring to another phone nr? No.

 

2) I am not aware that you could use the banking app without knowing the login pin (or fingerprint) and this is not stored on/sent to the phone

 

3) my phone is always locked, at least requires a pin/password/fingerprint or whatever to unlock. I would also power it off when I am forced to put in a locker or safe.

 

And wouldn't it be safer to have the phone with me at a gym, placed near me in a bag or so than in such an easy accessible locker?

 

thief doesn't need to change number they move sim to new phone

[JackGats]

"Since it is the first time that card will have been used on the new device, a one-off security passcode is demanded.

That verification passcode is sent by the bank to the stolen phone. The code flashes up on the locked screen of the stolen phone, leaving the thief to tap it into their own device. Once accepted, they have control of the bank account."

 

With my EU account the thief would still be left without my bank ID + PIN (or, alternatively, without my fingerprint). It would not be sufficient for the thief to have the SIM card. Any "one-off security passcode" would be sent only after being applied for through the banking app or the banking browser website (both of which require some form of PIN or ID).

 

In my Thai account access to the account is through a PIN on the banking app. SMS messages are only used for infos about payments/withdrawals.

 

[peterfranks]

9 minutes ago, scubascuba3 said:

thief doesn't need to change number they move sim to new phone

As I explained in another thread.

 

You can move sim to new phone, and download the bank app, after you have installed the K PLUS application and logged in to the system for the first time, you will be taken to the device changing step. Enter your account/debit card number, national ID card/passport number and the existing PIN. If the information is correct, you can use the service immediately.

 

If you don't have this info, the app will not work, and you will also not receive OTP.

[JackGats]

Regarding the particular case in the newspaper article, I wouldn't be surprised if the gym had cameras installed in the men's rooms but not in the women's rooms. Not only because males were considered the exclusive criminal gender but also because women needed to be protected from CCTV voyeurism. Overprotection and gender bias come at a price. At least in this case it was difficult to blame an (unkown) male.

[fdsa]

almost nobody changes the notification settings to "hide private data", so even a "locked" phone will turn on its screen and show the incoming SMS contents to anyone nearby.

just steal the phone with card and you could make purchases online.

[scubascuba3]

1 hour ago, fdsa said:

almost nobody changes the notification settings to "hide private data", so even a "locked" phone will turn on its screen and show the incoming SMS contents to anyone nearby.

just steal the phone with card and you could make purchases online.

Online purchases with just the card is easy enough. A locked phone won't allow you to go into the app and transfer money without code for phone and app

[Crossy]

15 minutes ago, scubascuba3 said:

Online purchases with just the card is easy enough.

 

My cards are set up with 2-factor authentication, the perp needs my phone and for it to be unlocked to make an online purchase. A text with an OTP is sent, you enter the OTP into the online purchase site.

 

I'm sure it's not totally secure but it worked well enough when someone tried to use my card details to buy some stuff in the US. I awoke to a bunch of authentication texts and an equal number of "please phone card security" texts. No transactions went through but I still had to get a new card with all the pain that goes with it.

 

 

[KannikaP]

On 9/8/2022 at 6:38 PM, Stocky said:

Maybe not such a good idea. I have different PINs for each of my cards.

And write them down on a bit of paper so you can forget them.

[scubascuba3]

1 hour ago, Crossy said:

 

My cards are set up with 2-factor authentication, the perp needs my phone and for it to be unlocked to make an online purchase. A text with an OTP is sent, you enter the OTP into the online purchase site.

 

I'm sure it's not totally secure but it worked well enough when someone tried to use my card details to buy some stuff in the US. I awoke to a bunch of authentication texts and an equal number of "please phone card security" texts. No transactions went through but I still had to get a new card with all the pain that goes with it.

 

 

I don't receive any OTPs although might do if i used a different device. I vaguely recall Halifax setting up 2 factor authentication, although that might be if using app

[topt]

1 hour ago, scubascuba3 said:

I don't receive any OTPs although might do if i used a different device. I vaguely recall Halifax setting up 2 factor authentication, although that might be if using app

I thought pretty much all UK financial institutions now used 2 FA even when you just want to sign in - or at least online? OTPs needed for bank, share trading sites, CC cos etc just to sign in.

 

With Lloyds if I try to set up a new payee I have to take a call on a registered number and then input a code that appears on my screen.

 

No idea about UK phone bank apps however.