Phantom Atm Cash Withdrawals

[Briggsy]

I've had my ATM card with Bangkok Bank going on 10 years and have never had a "phantom" withdrawal. My understanding is that in nearly all of these cases, the "phantom" is someone closest to you who also has a card/access to your account. My question is: Do you trust your wife?

I concur.

I have had numerous bank accounts in Thailand with various banks over 12 years. No 'phantom' withdrawals. I also have no joint accounts and nobody knows my pin numbers.

[PhilHarries]

A good Thai friend of mine had 100k baht taken from her Kasikorn account.

She got a Thai lawyer and all but the bank refused to refund the money.

Apparently it is not that uncommon and when she went to complain to the bank there was a women there who had 3m baht taken from her account.

Kasikorn seems to come up a lot in these ATM scams. It seems likely that they may involve bank employees ie inside jobs

It's certainly very possible it is an inside job. A long while back I had an account with Thai Farmers (now Kasikorn as I believe) and I had my wallet stolen complete with card. Stopped it immediately and went to the bank with the police report to get a new one. It only took about five minutes to get a new card in a sealed envelope linked to my account and all I had to do was use the PIN supplied and then change it to a personal one.

I thought at the time "how difficult would it be for a member of the bank staff to set themselves up with one of these cards and raid an account once in a while?" Probably not possible as the old card would need to be cancelled first but where there's a will there's a scam.

As an aside and a bit off topic but just recently I received an e mail from my bank, Vietcombank, telling me I had a very high balance and should take advantage of a higher interest account and I should contact the person to set one up.

1. The e mail stated my balance down to the last 47 cents.

2. The e mail was entirely in upper case letters.

3. There was no signiture on the mail confirming who the sender was (i.e. job title).

To say the alarm bells went off is an understatement but after some investigation the sender was a bona fide bank employee but that's still not to say it ain't a scam. Suffice it to say he/she has been re-educated in the niceties of bank/acc. holder correspondence.

[tombkk]

Just to add my two-pence: Never had "mystery withdrawals" and would alert bank and police if that happened. I am definiotely and postively not cool about it.

I hide my hand when entering the PIN code, and change the PIN code regularly.

There were no ATMs in Thailand when I moved here, so I have been with them from the beginning. Banks include BBL, SCB and TFB (the latter now called Kasikorn).

Oh, and I don't use free-standing ATM's connecting by cable or wifi to who-knows-where, but only those built into walls, preferrably of bank branches. This reduces the risk of data interception during transmission, I believe. Looking forward to ianguygil's input whether this precaution is necessary.

[Pib]

Oh, and I don't use free-standing ATM's connecting by cable or wifi to who-knows-where, but only those built into walls, preferably of bank branches. This reduces the risk of data interception during transmission, I believe. Looking forward to ianguygil's input whether this precaution is necessary.

Big 10-4 on using ATMs preferably at bank branches...I'm also generally OK with most ATMs in malls/Lotus/Big C/Makro/etc. But those standalone ATMs located by themselves around/in small markets, many tourist locations, temples, etc., is definitely a no-go with me except maybe in an emergency situation.

[ianguygil]

Just to add my two-pence: Never had "mystery withdrawals" and would alert bank and police if that happened. I am definiotely and postively not cool about it.

I hide my hand when entering the PIN code, and change the PIN code regularly.

There were no ATMs in Thailand when I moved here, so I have been with them from the beginning. Banks include BBL, SCB and TFB (the latter now called Kasikorn).

Oh, and I don't use free-standing ATM's connecting by cable or wifi to who-knows-where, but only those built into walls, preferrably of bank branches. This reduces the risk of data interception during transmission, I believe. Looking forward to ianguygil's input whether this precaution is necessary.

Our ATMs are encrypted from endpoint to endpoint, so it would be pretty hard to intercept the data whatever the transport (wifi, phone line, cell phone network). We use strong encryption so it would be almost impossible (or statistically improbable) to brute force the data stream.

I think the major risk of an ATM in less populated or controlled location is for somebody to install the actual skimming device which copies the card. If they try to do some "maintenance" on an ATM in or near a Bank branch they will probably have a large Bank guard with an even larger Bank gun asking them what they are doing. Most ATMs have the anti-skimming devices on them now, but some customers are really not observant and may not see something unusual installed on the slot where their card goes into the ATM.

Edited December 5, 2010 by ianguygil

[tombkk]

(...)

Oh, and I don't use free-standing ATM's connecting by cable or wifi to who-knows-where, but only those built into walls, preferrably of bank branches. This reduces the risk of data interception during transmission, I believe. Looking forward to ianguygil's input whether this precaution is necessary.

Our ATMs are encrypted from endpoint to endpoint, so it would be pretty hard to intercept the data whatever the transport (wifi, phone line, cell phone network). We use strong encryption so it would be almost impossible (or statistically improbable) to brute force the data stream.

Thanks, that is good to hear. However, I obviously don't know who you mean by "our ATMs". Would you think it is fair to say that this is true for all ATMs in Thailand, or would you make exceptions?

I think the major risk of an ATM in less populated or controlled location is for somebody to install the actual skimming device which copies the card. If they try to do some "maintenance" on an ATM in or near a Bank branch they will probably have a large Bank guard with an even larger Bank gun asking them what they are doing.Most ATMs have the anti-skimming devices on them now, but some customers are really not observant and may not see something unusual installed on the slot where their card goes into the ATM.

Yes, this has been in the news often enough. If I am not sure the ATM is designed to have a "thing" at the slot for the card, I don't use it. Incidentally, BBL ATMs confused me, but I see that they all look the same, so that should be OK.

Can you post a picture (or a link to a picture) of an ATM with a skimming device? I don't know what to look for.

[hhfarang]

All ATMs I use have camera surveillance installed near the top of the machine. The bank should have photos of the person who made the withdrawals if you have the date and time of the transaction on your statement.

Skimming is a big problem here. ATMS can be rigged with an add-on in front of the card slot that copies the magnetic strip as you insert it through the add-on into the real ATM slot. The added part is small and painted to match the ATM so it will be detected by only the very alert. Also, at the same time a very thin add on is placed over the ATM keyboard so that the pin is also captured by the add on as it actually allows the keys underneath it to be pushed. There are other ways but that's the most common one used in Thailand. Here are photos of how it works:

A normal looking ATM:

Fake keyboard:

Fake card reader (2):

Edited December 6, 2010 by hhfarang

[tombkk]

All ATMs I use have camera surveillance installed near the top of the machine. The bank should have photos of the person who made the withdrawals if you have the date and time of the transaction on your statement.

Skimming is a big problem here. ATMS can be rigged with an add-on in front of the card slot that copies the magnetic strip as you insert it through the add-on into the real ATM slot. The added part is small and painted to match the ATM so it will be detected by only the very alert. Also, at the same time a very thin add on is placed over the ATM keyboard so that the pin is also captured by the add on as it actually allows the keys underneath it to be pushed. There are other ways but that's the most common one used in Thailand. Here are photos of how it works:

A normal looking ATM:

atm1.jpg

Fake keyboard:

atm 2.jpg

Fake card reader (2):

atm 4.jpg

This is what the BBL ATMs look like, except that it's not yellow but shiny metal. I went to another ATM and later found out that they all like like that have this "thingy" attached over the lost.

Anyway, if I ever have a phantom cash withdrawl, thanks for the tip with the camera. This will prove that it wasn't me who took the money out, and will allow me to file a police report. I guess the bank will panic too and issue a new card right away, while checking whether they can return the money.

[ianguygil]

(...)

Oh, and I don't use free-standing ATM's connecting by cable or wifi to who-knows-where, but only those built into walls, preferrably of bank branches. This reduces the risk of data interception during transmission, I believe. Looking forward to ianguygil's input whether this precaution is necessary.

Our ATMs are encrypted from endpoint to endpoint, so it would be pretty hard to intercept the data whatever the transport (wifi, phone line, cell phone network). We use strong encryption so it would be almost impossible (or statistically improbable) to brute force the data stream.

Thanks, that is good to hear. However, I obviously don't know who you mean by "our ATMs". Would you think it is fair to say that this is true for all ATMs in Thailand, or would you make exceptions?

I think the major risk of an ATM in less populated or controlled location is for somebody to install the actual skimming device which copies the card. If they try to do some "maintenance" on an ATM in or near a Bank branch they will probably have a large Bank guard with an even larger Bank gun asking them what they are doing.Most ATMs have the anti-skimming devices on them now, but some customers are really not observant and may not see something unusual installed on the slot where their card goes into the ATM.

Yes, this has been in the news often enough. If I am not sure the ATM is designed to have a "thing" at the slot for the card, I don't use it. Incidentally, BBL ATMs confused me, but I see that they all look the same, so that should be OK.

Can you post a picture (or a link to a picture) of an ATM with a skimming device? I don't know what to look for.

I really can not speak for the other banks and the security measures they take. But I would excpect that they all do the same.

I will look for a picture, more likely a site on ATM skimming devices.

[ianguygil]

All ATMs I use have camera surveillance installed near the top of the machine. The bank should have photos of the person who made the withdrawals if you have the date and time of the transaction on your statement.

Skimming is a big problem here. ATMS can be rigged with an add-on in front of the card slot that copies the magnetic strip as you insert it through the add-on into the real ATM slot. The added part is small and painted to match the ATM so it will be detected by only the very alert. Also, at the same time a very thin add on is placed over the ATM keyboard so that the pin is also captured by the add on as it actually allows the keys underneath it to be pushed. There are other ways but that's the most common one used in Thailand. Here are photos of how it works:

A normal looking ATM:

Fake keyboard:

Fake card reader (2):

Excellent photos. Great evidence to see how convincing these things can look.

[TheWalkingMan]

Whenever I use an ATM machine I always check to see if any of the parts are loose such as the picture above.

TheWalkingMan

[Kabinboy]

Whenever I use an ATM machine I always check to see if any of the parts are loose such as the picture above.

TheWalkingMan

The camera's on ATM's are useless as most of these crooks wear hats and keep their head down.