Debit Card Fraud Farce

[473geo]

A little off topic but probably worth mentioning.

The Bank of Thailand issued a regulation about three years back which requires that when you use a credit card the slip that comes out of the machine must show your card number as follows:

XXXX XXXX XXXX 1234

In other words only the last 4 digits can be printed.

The Bank of Thailand also issued a regulation, at the same time, which says that merchants cannot record your full card number in any other manner.

Reason? Obviously to try to seriouly reduce theft of credit card numbers.

The bottom line is that many merchants still print the 16 digits on the credit card slip that they ask you to sign.

I have challenged many merchnats about this including two very high profile home products companies. They refuse to do anything about it saying it's too difficult. I also checked whether it is difficult to program their machine which spits out the slip. It's not, takes two seconds and requires no advanced knowlwsge of any sort.

Just recently I was with my adult son at a high profile car maintenance outlet, my Thai son gave his credit card to pay for the services and the machine printed all 16 numbers. My son queried this and was simply abused by the 18 year old loud mouth cashier girl. Additionally she had quickly pulled a small notepad from her purse and had writen down the 16 digits.

We contacted the police who did come to the shop and indicated that they would investigate. In front of the police my son insisted strongly that the shop reverse the credit card transaction and that they give him all copies of every slip that had been printed and insisted that the police allow him to rip uop the page of the girl's notepad. The police agreed. Meantime my daughter in law went to an ATM and they paid cash for the services.

Just as we getting in the car two technicians came over and said 'thank you'.

Machines can be set up to print two slips - merchant copy containing the full card details, and a customer copy showing xxxx xxxx xxxx 1234 - would that fall within the Thai ruling, and if one did not know this, would one just accept on receiving a customer copy that the merchant copy is the same?

As far as visa verify goes - yes on the internet you will be required to verify your pin, but at a merchant machine where customer not present is used you do not require a pin.......only details held on the card....this is why you can make a payment over the telephone if you wish.......

Of course things may operate differently in Thailand I do not have a Thai card so perhaps speaking out of turn.....

You do not (should not) be using your pin on the internet ,or anywhere other than POS Chip and PIN and ATMs. On all other occassions you should be using the VCC or three digit security code (the last three numbers of the seven digit security code) on the back of your card printed on the signature strip.

Verify by Visa (VbyV) is an additional, optional, security messure which you set up with your issuing bank (although it may appear to you on the web sight as if you are doing it with the web site). Soem outlets use it, some will not let you carry out a transaction without it. Outlets who insist on VbyV usually allow 3 purchases before they insist on VbyV use

NEVER use your PIN except at POS and ATM. If you do disclose your your PIN in this way your card issuer will not refund any losses.

You are of course correct, apologies, didn't intend to mislead - I meant the Visa verify (PIN/Password) for internet transactions, (not your card PIN number which of course is not the same as your visa verify PIN/Password) .

[jfchandler]

When you can find someone living in Thailand who lost funds from their Thai bank account and had the money refunded by their Thai bank, then you can start talking....

Until then, I'm relying on numerous accounts of TV members posted here over time of having lost funds from their accounts in one fashion or another, and basically getting the cold shoulder from their Thai bank in terms of doing anything to return their funds....

The fact that VISA has absolutely no fraud protection for its customers with Thai bank issued cards ought to tell you something about the way it works here....

The only good thing is, people can use their U.S. bank issued cards abroad, and still have the U.S. fraud protection laws apply...even though the transaction occurs outside the U.S. And as was the case in my episode as described above with my wallet being stolen and debit card fraudulently used within the hour it took me to contact my bank, I got my $1000 plus back from my U.S. bank within about a week....

Feel free to demonstrate a Thai bank, any Thai bank, that would do the same...

And guess what the Thai banks' fraud policy is???

SCREW YOU!!!

Do you have a source for this policy or are you just talking out your ass ??

[bangkockney]

When you can find someone living in Thailand who lost funds from their Thai bank account and had the money refunded by their Thai bank, then you can start talking....

Seems like if you kick up enough of a fuss and the evidence is overwhelming, K-Bank at least, will relent:

Thu 14 Dec 06, the KBANK called and informed me that the bank was willing to refund 50% of the amount stolen. I did not accept the offer. In accordance with Thai bank code, the bank has to be responsible for all the money stolen and any charges incurred on the account as a result of fraudulent transactions.

Mon 18 Dec 06, I sent two letters by EMS to request two of KBANK's top management executives to reconsider this case and give their response in writing to me by the end of 2006.

Wed 27 Dec 06, I received a call from KBANK informing me that the bank decided to refund me 100% of the total amount stolen by the ATM Fraudster.

Fri 29 Dec 06, I went to KBANK Klong Luang Branch and filled in a Request for Refund Form. About three hours later, the total amount stolen was transferred to my bank account by the Bank HQ.

Source

[scorecard]

A little off topic but probably worth mentioning.

The Bank of Thailand issued a regulation about three years back which requires that when you use a credit card the slip that comes out of the machine must show your card number as follows:

XXXX XXXX XXXX 1234

In other words only the last 4 digits can be printed.

The Bank of Thailand also issued a regulation, at the same time, which says that merchants cannot record your full card number in any other manner.

Reason? Obviously to try to seriouly reduce theft of credit card numbers.

The bottom line is that many merchants still print the 16 digits on the credit card slip that they ask you to sign.

I have challenged many merchnats about this including two very high profile home products companies. They refuse to do anything about it saying it's too difficult. I also checked whether it is difficult to program their machine which spits out the slip. It's not, takes two seconds and requires no advanced knowlwsge of any sort.

Just recently I was with my adult son at a high profile car maintenance outlet, my Thai son gave his credit card to pay for the services and the machine printed all 16 numbers. My son queried this and was simply abused by the 18 year old loud mouth cashier girl. Additionally she had quickly pulled a small notepad from her purse and had writen down the 16 digits.

We contacted the police who did come to the shop and indicated that they would investigate. In front of the police my son insisted strongly that the shop reverse the credit card transaction and that they give him all copies of every slip that had been printed and insisted that the police allow him to rip uop the page of the girl's notepad. The police agreed. Meantime my daughter in law went to an ATM and they paid cash for the services.

Just as we getting in the car two technicians came over and said 'thank you'.

Machines can be set up to print two slips - merchant copy containing the full card details, and a customer copy showing xxxx xxxx xxxx 1234 - would that fall within the Thai ruling, and if one did not know this, would one just accept on receiving a customer copy that the merchant copy is the same?

As far as visa verify goes - yes on the internet you will be required to verify your pin, but at a merchant machine where customer not present is used you do not require a pin.......only details held on the card....this is why you can make a payment over the telephone if you wish.......

Of course things may operate differently in Thailand I do not have a Thai card so perhaps speaking out of turn.....

I know for a fact that the reason the Bank of Thailand instigated the policy about printing only the last 4 digits is aimed at reducing the access at the merchant end to stealing card numbers.

Several times when I've queried why the machine had printed all numbers on the customer copy I have taken notice of what was printed on the merchants copy and in every case all 16 numbers had been printed.

But you have a good point, maybe the machine can be set up to print XXXX XXXX etc on the customer copy and the full 16 digits on the merchants copy.

My reason to check all of this is that I've had my card number stolen three times, Visa card issued by a Thai Bank. On every occasion there were large 'purchases', say US$400 to US$800, in: Sydney, Manila, Hong Kong, and Seoul, all on the same day and pretty much the same time (or a similar pattern).

However I must admit that my Thai bank took it very seriously, they gathered all the information quickly (didn't really ask me to do such work), bank asked me to bring my passport to my local branch so that they could get a copy of every page to prove that I was in Thailand at the time. Bank forwarded it all quickly to the Visa people and the bank did regular follow up action until it was all reversed. Took about 4 weeks from memory.

But there is another point, my bank manager mentioned "Please be very careful where you leave any credit card slips*, and where you actually use your Visa card because it's Visa policy / policy of many banks that if your number is stolen three times then you are now a serious suspect to be involved in the stealing of the number".

My bank manager also mentioned, never give your credit card slips to 'stalls' inside supermarkets who give away 'free gifts' if you can prove you have spent over 500Baht / 1,000Baht etc.

[jfchandler]

That's an interesting post you've linked to...but it's not exactly the same kind of issue we're talking about here...

In particular, the fraud in that guy's blog account involved a straight KBank ATM card, not a VISA or MC logo card, and not a card that could have been used for swipe and sign purchase transactions at merchants.

So, rather than a situation where the guy had his card flat out stolen or cloned by a merchant or such, what kind of circumstance would allow a 3rd party to gain access to someone's account for cash withdrawals using a straight ATM card???

That's probably why KBank relented.... Indeed, there have been quite a few reported cases where it's been the banks' own employees either draining/transferring the funds themselves or giving the necessary account information to third parties such as boyfriends, etc etc...

But if the situation has been the more normal VISA/MC logo debit card being stolen and used for purchases by the thief, I'm not sure the bank would have had the same response.

When you can find someone living in Thailand who lost funds from their Thai bank account and had the money refunded by their Thai bank, then you can start talking....

Seems like if you kick up enough of a fuss and the evidence is overwhelming, K-Bank at least, will relent:

Thu 14 Dec 06, the KBANK called and informed me that the bank was willing to refund 50% of the amount stolen. I did not accept the offer. In accordance with Thai bank code, the bank has to be responsible for all the money stolen and any charges incurred on the account as a result of fraudulent transactions.

Mon 18 Dec 06, I sent two letters by EMS to request two of KBANK's top management executives to reconsider this case and give their response in writing to me by the end of 2006.

Wed 27 Dec 06, I received a call from KBANK informing me that the bank decided to refund me 100% of the total amount stolen by the ATM Fraudster.

Fri 29 Dec 06, I went to KBANK Klong Luang Branch and filled in a Request for Refund Form. About three hours later, the total amount stolen was transferred to my bank account by the Bank HQ.

Source

[bangkockney]

That's an interesting post you've linked to...but it's not exactly the same kind of issue we're talking about here...

The thing that I took away from it was:

In accordance with Thai bank code, the bank has to be responsible for all the money stolen and any charges incurred on the account as a result of fraudulent transactions.

It would therefore be interesting to know exactly what "fraudulent transactions" are defined as in the Code - it could well cover POS, but who knows.

I assume that the document would only be available in Thai too - haven't found it in English - which makes researching it that little bit harder.

[jfchandler]

And the final chapters of the KBank fraud victim's saga... I wouldn't wish this kind of mess on my worst enemy....

Finally, on 1 November 2006, I was called by the Bangrak Police to pick up a copy of the Arrest Warrant for ATM Fraudster dated 25/09/2006 (Ref No. 1819/2549). The Police in charge told me that his investigation task had been completed and from now on it is up to another unit of his Police Station to catch the thief. He also told me that since all they had is low resolution CCTV clips and blurred pictures of the criminal, to catch the thief was like looking for a needle in a haystack!

And the important things that the victim never got any answers about....

Questions Waiting for Acceptable Answers:

- Who Done It - copied my ATM card information and produced the counterfeit card or "white-card"?

- How was my ATM card skimmed (ATM card information copied) and PIN captured?

- Who is the ATM thief or criminal that carried out the ATM withdrawals?

- Is it an inside job or outside financial fraud criminals???

- Have all the banks in Thailand implemented sufficient ATM security features such as prevention

from card skimming and trapping, good remote monitoring of ATMs, and reliable and robust

customer database security and controls?

- Why did the Thai banks not work in good cooperation amongst themselves and with the police in

providing prompt and efficient actions to deal with ATM frauds - in my case it took almost 3

months for the police to gather all evidences needed from the 4 banks to complete the

investigation so as to issue the Arrest Warrant for the criminal (the investigation police mentioned that it was

partly due to government bureaucracy and also partly due to corporate sneakiness)?

Need I say any more???

[jfchandler]

That's that guy's account of what the bank code supposedly says... Who knows if his intepretation is correct...

All I know is, in day to day situations involving both Thais and farangs, the Thai banks don't seem to operate that way....as in, taking responsibility when the thefts occur.

The thing that I took away from it was:

In accordance with Thai bank code, the bank has to be responsible for all the money stolen and any charges incurred on the account as a result of fraudulent transactions.

It would therefore be interesting to know exactly what "fraudulent transactions" are defined as in the Code - it could well cover POS, but who knows.

I assume that the document would only be available in Thai too - haven't found it in English - which makes researching it that little bit harder.

[glomp]

I have this totaly radical idea, im sure i will make millions somehow from this easy to implement but really hard and difficult to grasp idea. I did focus groups, funded two academic papers and interviwed several hundred people about this. After many years of trial and error i think i have found the solution.

I will recomend people to pay CASH in countries where fraud and card skimming is rife. Im sure i can patent or somehow monetise this idea as nobody seems to have thought about this before.

[jfchandler]

I get 4%+ APY interest on my U.S. bank account deposits by using U.S. debit cards, and am fully protected by U.S. federal law against fraud losses....

How's your cash approach looking by comparison?

[473geo]

I have this totaly radical idea, im sure i will make millions somehow from this easy to implement but really hard and difficult to grasp idea. I did focus groups, funded two academic papers and interviwed several hundred people about this. After many years of trial and error i think i have found the solution.

I will recomend people to pay CASH in countries where fraud and card skimming is rife. Im sure i can patent or somehow monetise this idea as nobody seems to have thought about this before.

Fine lets have your company address and a suitable refund policy, then the guy who gets robbed of a million baht on his way to purchase a car can come to you to claim a return of his missing funds..............of course nobody would abuse your refund policy........ honest........I mean carrying loads of cash is very secure these days...

[glomp]

So your arguments are "have a US bank" ? Good luck for you being able to be customers for these wunderbanks than never doubt your claims from dody receipts that might or might not have your sig.

Not everyone comes from the US or buys one millon bath toys each day. I'd rather have my savings in my portfolio getting 13% than having to worry about some dickhole copying the card and causing me alot of grief for 4%.

[jfchandler]

Please do point me to an INSURED, PRINCIPAL PROTECT account, comparable to U.S. government insured bank deposits, that earns your 13%....

It's easy to gamble with one's money in the stock market.... Even even for those of us that do that, some of us, especially the nearing or at retirement age folks, think it's a pretty smart move to keep a reasonable portion locked away in safe, government insured accounts that won't melt away with the next market crash....

When 7 yr Certificates of Deposit are paying under 4%, I'm quite happy to keep my "safe" cash in rewards bank accounts that earn 4%+.. And certainly feel a whole lot safer with it there than walking around the streets of BKK carrying wads of baht... A fool and his baht are soon parted...

[mkawish]

Just a note. Bangkok bank cards now have chip and pin.

Correct!

But....

the chip card can only at this moment in time be used only with the Bangkok Bank authorized ATMs!

However, the non-chip card can be used across other banks' atm with a fee attached.

Thought you might want to know, in case you live in up country where atms are not readily accessible.

[Straight8]

The U.S., for example, has pretty strong consumer protection laws relating to stolen or fraudulent debit and credit card transactions -- the federal law pretty much limits a person's liability to no more than $50 for debit card fraud as long as you report to the bank within TWO DAYS of becoming aware of the theft/fraud.

By comparison, I can't tell that Thailand has any similar kind of consumer protection laws regarding credit and debit card fraud.

2 Days??

What happens if you only notice the fraud after 2 days, as lets face it, unless you log onto your card online and check everyday, it might be alot more than 2 days if you have been screwed. Let's say you use your card and someone, somewhere has copied the details, whether it be a shop or restaurant etc etc.

You have your card and all appears well. Next time you use the card is 10 days later and you notice fraud activity.

Are you saying that now you are not covered?

That doesn't sound correct, at least not in Australia. You are covered for fraud 2 days or 30 days, as soon as it is noticed it is investigated.