ATM Scam

[marshbags]

The Nation Friday 21-09-07

Ref url:- http://www.nationmultimedia.com/2007/09/21...al_30049718.php

Quote:-

New scam has banks scrambling

Commercial banks and the police, are battling a new ATM theft technique in which fake keypads record pin numbers and personal information.Published on September 21, 2007

The thieves then produce clone cards to empty bank accounts.

Thai Bankers' Association secretary-general Twatchai Yongkittikul said the fake keypads feel hard to the touch and that cardholders should immediately cancel their transaction if the keypad feels strange and notify the bank immediately.

He did not say exactly when this new technique was detected, but said thefts had occurred "occasionally".

He said the banks, "if proved at fault", would be responsible for the stolen money, adding that though financia.

In a TV interview yesterday, Twatchai said he believed it was a large-scale operation that involves computer experts and people with experience in plastic and rubber products, as the fake keypads looked very much like the real thing.

According to Twatchai, the technique also involved the use of false decoders, which record personal information of cardholders stored in the magnetic strip on ATM cards. The thieves then used two sets of information - pin numbers and cardholder's information - to produce cloned ATM cards to withdraw money.

Twatchai said he did not think bank officials were cooperating with the thieves.

The Nation

Unquote.

Mods please edit if posted elsewhere

marshbags

Edited September 21, 2007 by marshbags

[TAWP]

This is almost 2 years old if not more in Europe. Does no-one here follow international events?

[lazeeboy]

This is almost 2 years old if not more in Europe. Does no-one here follow international events?

maybe 2 years old in europe but new here ..........

[TAWP]

Which brings up the point that international events and information-sharing exists. Anyone working as head of security would try to stay up to date with the latest scams, no?

[iforget]

This is almost 2 years old if not more in Europe. Does no-one here follow international events?

It's not exactly new in Thailand either. See http://www.phuketgazette.net/news/index.as...yes&Id=5914 (August 29) or http://www.phuketgazette.net/news/index.as...yes&Id=5122 (July 2006). And that's just in Phuket

The first link has good pix of ATM scanners so people will know what to look out for.

[naka]

This is almost 2 years old if not more in Europe. Does no-one here follow international events?

It's not exactly new in Thailand either. See http://www.phuketgazette.net/news/index.as...yes&Id=5914 (August 29) or http://www.phuketgazette.net/news/index.as...yes&Id=5122 (July 2006). And that's just in Phuket

The first link has good pix of ATM scanners so people will know what to look out for.

Also look out for the "Camera in a pamphlet box" used to record Pin.

Hold your left hand over keypad when punching in the Pin.

Naka.

[mikethevigoman]

This is almost 2 years old if not more in Europe. Does no-one here follow international events?

It's not exactly new in Thailand either. See http://www.phuketgazette.net/news/index.as...yes&Id=5914 (August 29) or http://www.phuketgazette.net/news/index.as...yes&Id=5122 (July 2006). And that's just in Phuket

The first link has good pix of ATM scanners so people will know what to look out for.

Also look out for the "Camera in a pamphlet box" used to record Pin.

Hold your left hand over keypad when punching in the Pin.

Naka.

I had 2300 pounds taken from my uk debit card on a swipe transacrion in s korea, amd ive never been there !

[chiang mai]

And on this subject the man said:

K. Prayootd said the rise in counterfeiting may be the result of Thailand’s neighbors switching from cards with magnetic memory

strips to “smart” cards with computer chips embedded in them. As “smart” cards cannot be read by the skimmers, K. Prayootd is urging card users in Thailand to switch to smart cards as soon as they find a bank that can issue them.

The man must surely know that no Thai banks issue chip and pin cards - what an embarrassing statement to make.

[Scott]

So which ATMs are at most risk of this scam? Is there a particular bank that's more prone? Are inside ATMs safer than outdoor ones?

[naka]

And on this subject the man said:

K. Prayootd said the rise in counterfeiting may be the result of Thailand’s neighbors switching from cards with magnetic memory

strips to “smart” cards with computer chips embedded in them. As “smart” cards cannot be read by the skimmers, K. Prayootd is urging card users in Thailand to switch to smart cards as soon as they find a bank that can issue them.

The man must surely know that no Thai banks issue chip and pin cards - what an embarrassing statement to make.

Ah ! But ATM's the world over still read the mag strip. This is not going to change anytime soon

as many countries including the US still do not issue chip and pin cards.

This will be a problem until they stop producing cards with the mag strip.

Naka.

[taxexile]

best to use those that are situated inside the bank itself.

[aka_jack]

I remember reading this back in the uk last year about chip and pin looks like nothing is that safe !!

Shell said the suspension of chip and pin was a temporary measure

Petrol giant Shell has suspended chip-and-pin payments in 600 UK petrol stations after more than £1m was siphoned out of customers' accounts.

Eight people, including one from Guildford, Surrey, and another from Portsmouth, Hants, have been arrested in connection with the fraud inquiry.

The Association of Payment Clearing Services (Apacs) said the fraud related to just one petrol chain.

Shell said it hoped to reintroduce chip-and-pin as soon as possible.

Plastic crime

The fraud is being investigated by the Metropolitan Police cheque and plastic crime unit.

"These Pin pads are supposed to be tamper resistant, they are supposed to shut down, so that has obviously failed," said Apacs spokeswoman Sandra Quinn.

She said Apacs was confident the problem was specific to Shell and not a systemic issue.

A Shell spokeswoman said: "Shell's chip-and-pin solution is fully accredited and complies with all relevant industry standards.

"We have temporarily suspended chip-and-pin availability in our UK company-owned service stations.

"This is a precautionary measure to protect the security of our customers' transactions.

"You can still pay for your fuel, goods or services with your card by swipe and signature.

"We will reintroduce chip-and-pin as soon as it is possible, following consultation with the terminal manufacturer, card companies and the relevant authorities."

Shell has nearly 1,000 outlets in the UK, 400 of which are run by franchisees who will continue to use chip-and-pin.

BP is also looking into card fraud at petrol stations in Worcestershire but it is not known if this is connected to chip-and-pin.

[Edorf]

And on this subject the man said:

K. Prayootd said the rise in counterfeiting may be the result of Thailand’s neighbors switching from cards with magnetic memory

strips to “smart” cards with computer chips embedded in them. As “smart” cards cannot be read by the skimmers, K. Prayootd is urging card users in Thailand to switch to smart cards as soon as they find a bank that can issue them.

The man must surely know that no Thai banks issue chip and pin cards - what an embarrassing statement to make.

Your statement is not correct. During the last 4 months all the cards I have at Thai Military Bank (TMB) has been replaced by smart cards. Now, whether or not the ATM's read from the strip or the chip, that is a different matter. If the skimmers can read anything from a chip card that also has a strip I do not know anything about. My point is only that chip cards are indeed issued.

Edit: spelling

Edited September 21, 2007 by Edorf

[peterpanner]

The ATM's of Bank of Ayudhya show cardless ATM promotions. Any knowledge of that, anyone?

[britmaveric]

Not really new - been doing fakes in thailand for years.

[cali4995]

If you study the photos of this "rigged atm" in the phuket gazette news story

rigged atm photos

not very many atm machines have a card entry slot which is not recessed far

into the machine. this particular one, i think bank of ayudhaya? is almost flat.

also the bogus keypad is raised almost 2-3 centimeters off the deck. i just tried

to make a note of the features in case i ever saw anything similar. those promo

brochures and pamphlet boxes are stuck all over some of those machines.

[chiang mai]

And on this subject the man said:

K. Prayootd said the rise in counterfeiting may be the result of Thailand’s neighbors switching from cards with magnetic memory

strips to “smart” cards with computer chips embedded in them. As “smart” cards cannot be read by the skimmers, K. Prayootd is urging card users in Thailand to switch to smart cards as soon as they find a bank that can issue them.

The man must surely know that no Thai banks issue chip and pin cards - what an embarrassing statement to make.

Your statement is not correct. During the last 4 months all the cards I have at Thai Military Bank (TMB) has been replaced by smart cards. Now, whether or not the ATM's read from the strip or the chip, that is a different matter. If the skimmers can read anything from a chip card that also has a strip I do not know anything about. My point is only that chip cards are indeed issued.

Edit: spelling

Yes you are correct, technically speaking. Perhaps what I should have said if that no Chip and Pin terminals have been deployed in Thailand either in ATM's or POS. The Chip in Chip and Pin is the primary method of communicating the PIN to the host. The Chip contains a key (or algorithm) which allows the card AND the terminal device to be validated. But the fallback in the event the Chip is damaged is to revert to the magnetic stripe. In summary, Chip and PIN cards issued in Thailand will only provide the extra layer of protection when used in cross border transactions where Chip and PIN terminals are deployed.

[H2oDunc]

The ATM's of Bank of Ayudhya show cardless ATM promotions. Any knowledge of that, anyone?

Hi the cardless ATM transactions work by giving you a pin number. You then give that pin number to the person you want to recieve the money, similar to western union. The person then goes to any Ayudayah ATM, punches in the numbers and gets their cash. No card needed, Simple and effective.

[ZZZ]

K-Bank, and other banks, have a service where they will send you an sms or maybe an email instantly every time your card is used. This way you will get an early warning if someone else is using your card information.

It's also useful if you need to track your missus/GF's usage or even to keep track of your own usage.

[H2oDunc]

How to avoid the scamers!

Open 2 accounts with internet access. Get 1 account with a card and the other without. Keep ALL your money in account WITHOUT a card. When you want to take money out of the ATM go online and transfer the amount you wish to withdraw to account with the card. Go to ATM and withdraw it. If card is ever cloned you are not going to loose anything as you have nothing in account to remove. Simple but effective

[froglegisgood]

How to avoid the scamers!

Open 2 accounts with internet access. Get 1 account with a card and the other without. Keep ALL your money in account WITHOUT a card. When you want to take money out of the ATM go online and transfer the amount you wish to withdraw to account with the card. Go to ATM and withdraw it. If card is ever cloned you are not going to loose anything as you have nothing in account to remove. Simple but effective

there is no safe method to process a transaction over a public system, whether an ATM or a computer in an internet cafe. The issue being that is you are on a fake atm, il will record enough to siphon your account even if you don't have a CC on it. If you use a computer in a public area, most will be a risk of being infected with a key logger that will send each keystroke encrypted to an email account where they can be decrypted and then used. This is why banks now have moved to a pin keying system where you click on digit on the screen... problem the guy behind you can see each click and it is difficult to hide

the ATM card with a chip is today the only safe way to make a transaction providing the terminal reads the chip and actually uses the information. To my knowledge the only country in the world who implemented this is France, where EACH terminal in ANY shop or bank in France was modified to accept transaction with pin/chip cards, and this back in 1995! The shop who did not upgrade could not transact any longer. This has reduced the theft to almost zero in France which if you remember is the country where the card with an embedded chip was invented - cocoricooo, for those who understand! ( I think Moreno invented it)... unfortunately nobody else is following.

an alternative seems to be popping up where you give a pin or word code to your bank that will expect a coded reply back from you. I mean I enter my card in the ATM and process a transfer or withdraw, I key in my number, the bank will send my back my preprogrammed code word and request a matching additional number I can easily compute or calculate based on the code I received, so I can authorise the transfer, knowing that it was made with my bank and nobody else and the bank would know its me since I knew how to react to my preprogrammed code which only is recorded at the bank. You could even code an answer back for stress situation where you give the response and it limits to a small withdrawal or say no credit on account and start tracking videos for attempt to steal money if you are physically attacked.

An another, no full proof is the one time password provided by a little devise you carry attached to your key and that gives you a new 8-12 digit number that changes every 30sec or 1 min to be typed with your pin. The number is valid to login to your account only once, and it can not be predicted. No so easy as you need to have your card, your little devise and remember you additional pin.

It is however very good if you have money in an account and use internet to transac, probably one of the safest way today.

There are also pin sent by mobile phone, cheaper version of the above, less secure but better than nothing.

in other words, AVOID at any cost processing a transaction over a public unsafe system, i mean computer in a hotel lobby, business center, internet cafe etc, or even your computer at home if you have no guarantee of total security with antivirus and firewall.

Use only ATM inside bank area or in very visible high traffic area, like inside shopping centers, and if you have large amount of money directly accessible on the account you are using on internet, only use a bank that will give you decent security measure like a TWO factor authentication system like the devise generating an additional pin number.

hope this is clear and will avoid some nightmares to any one who is informed and aware

f'leg

[naka]

K-Bank, and other banks, have a service where they will send you an sms or maybe an email instantly every time your card is used. This way you will get an early warning if someone else is using your card information.

It's also useful if you need to track your missus/GF's usage or even to keep track of your own usage.

You don't get a message if it was an ATM transaction. I wonder why not.

Naka.

[chiang mai]

K-Bank, and other banks, have a service where they will send you an sms or maybe an email instantly every time your card is used. This way you will get an early warning if someone else is using your card information.

It's also useful if you need to track your missus/GF's usage or even to keep track of your own usage.

You don't get a message if it was an ATM transaction. I wonder why not.

Naka.

Credit Card issuers tend to be more vigilant and have more sophisticated software systems in place to manage credit fraud because the loss exposure might end up on them. Banks and ATM transactions however are not dealing in credit losses but more in direct loss of customers cash funds on deposit. Sad but true.

[Basil B]

"the ATM card with a chip is today the only safe way to make a transaction providing the terminal reads the chip and actually uses the information. To my knowledge the only country in the world who implemented this is France, where EACH terminal in ANY shop or bank in France was modified to accept transaction with pin/chip cards, and this back in 1995! The shop who did not upgrade could not transact any longer. This has reduced the theft to almost zero in France which if you remember is the country where the card with an embedded chip was invented - cocoricooo, for those who understand! ( I think Moreno invented it)... unfortunately nobody else is following."

Many countries use chip & pin, Here in the UK we have been using it for many years, problem is that when you stop it in one country they will move to another country like Thailand where chip & pin is not implemented, and others start to work on ways to crack chip & pin.

BB

[34chevman]

As a victim of ATM fraud and having the experience of sorting out the mess with my bank (Westpac), it was clear after, that no ATM cards are safe from fraud.

The event took place last year in either Bangkok or Pattaya of which I used about 4 ATM's in high volume traffic area's, with the unauthorised transactions taking place in **France** on the night I was in transit high above in the plane on route back to Australia.

In the space of about 10 hours, they had sucked $2,000AUD from my account.

I was really lucky as when I arrived at Sydney, I used an ATM to withdraw some money out for a taxi, only too find I had 'insufficent funds'.....when I knew I had.

Telephoning the bank, I found out different and had a stop placed on the card...which did not take effect until 3 days later!!..with a further $500AUD sucked out before the cancellation went through the system - Westpac and Mastercard.

If I had of not used that card too withdraw money out for a taxi, I hate too think what the end result would have ended up being.

I dont think there is any real safe way when it comes to ATM's.

They are certainly not as secure as the banks like having us too believe.

My own methods now are rather long drawn when it comes to security...

Firstly, I inform the bank of my travels, then ask them to put a stop on the card.

When it comes to withdrawing, I telephone them up, regardless of the cost, and go through all the security questions etc to validate who I am, then ask them to unstop it, informing them how much I will be withdrawing, and after, telephone them again and put a stop on it.

As you can imagine, the cost of overseas calls back too your bank can be very expensive, but after what I went through, it was clear the banks have no real security when it comes too ATM's.

[jomtienbob]

The Nation Friday 21-09-07

Ref url:- http://www.nationmultimedia.com/2007/09/21...al_30049718.php

Quote:-

New scam has banks scrambling

Twatchai said he did not think bank officials were cooperating with the thieves.

The Nation

Unquote.

Mods please edit if posted elsewhere

marshbags

A few years ago I lost my BKK bank ATM card on a Sunday Evening. I just figured oh ###### I'll go report it in the morning, there is no way anyone can access the account without the pin no anyhow. So I went to work, and at lunchtime I went to my branch and they asked me what time I lost it, which I wasn't sure of, but it was Sunday night. They then advised that the account had been emptied via a BKK Bank ATM in town around 9am Mon morning. I went to that BKK bank branch to find that there was 24 hour video surveillance, so I asked if we could see the tape. They told me I needed a police order. Then the police told me I needed a transaction report from the Bank. It took me 2+ weeks to get the transaction report, which once I did I went to the Police Captain and got the written police order and went with 2 constables to the Bank. The Bank then told me they could not comply because the Bank manager wasn't available. We made 2 more appointments to which he didn't show up to.

I finally got to talk with the assistant Mgr and he advised that they cannot give out a copy of the security tape but we could watch it, but we'd need another police order. A few days latter I returned with 1 constable (they were getting tired of all this) and the order and we were told the Manager wasn't there and he needed to be there at the time. I made an appointment for his earliest available time the following week. The next week the constable did not turn up as they were no doubt sick of the goose chase. I was shown a 2 minute snippet of the video of an approximately 6 foot tall Farang guy making a transaction at the ATM. There were some very obvious issues though. I am 5'3" with shoes on. The time on the video snippet they showed me was some 20 mins latter than that of the bank transaction I had in my hands. The Bank manager just said, that is YOU!! and the ATM machine and the security video don't have exactly the same time on them. I said maybe, but not 20 mins! he ignored all other discussion and brushed me off as quickly as he could. I thought what are you trying to hide?

The bank people were obviously trying to avoid any further investigation into this matter, even though I had already written off the 35,000 as gone. My comments to them was that I was far more worried about how the pin no was accessed! Their argument was that I was the one who withdrew the money! I had 30+ wittinesses that I was at work at that time and that the video clearly shows that their pictures they showed me was not even close to looking like me. Ahh but all farangs look the same to them I suppose.

Anyhow I went back to the Police Capt. and he suggested that there is probably not much that you can prove against the bank or their employees, and just don't ever use that bank again and mai bpen rai. There's not much you can do really! So I said but what about the pin no? He said you'll need a lot more than the 35k to fight and prove Bangkok Bank at fault on that one! So we were left with the famous Thai standoff. So I have changed Banks and don't use ATM cards very much anymore. It's a bit inconvenient really, but I'll not take the chance again.

But what the Banks aren't doing is going after these crooks. They'd rather people do not know that your money in Thailand isn't so safe really. They'd rather try and pin the blame of the loss on the customer rather than admit that!!

I'll bet anything that the story would be different if I was Thai.

Be warned!

[LivinLOS]

Thai banking security is woeful..

It took me about 10 mins of thinking to find a way to empty my ex's private bank account after her demise (no will etc) and that would work on anyones account.

[34chevman]

jomtienbob: Dont be suprised if the banks are in on it. A friend of mine withdrew 1,000bht from ATM opposite the Nana, in soi4, sukumavit, only too appear on his bank statement as 2,000bht withdrawn!

[jomtienbob]

Oh BTW the ATM card I used wasn't a credit card. Just a simple ATM card on a passbook account.

[UnknownPoster]

Repeat after me.

Bangkok Bank sucks.