Bangkok Bank

[ianguygil]

The basic assumption in this thread, mainly the rantings from Jon (or John, can't remember) that the ID is key to security is incorrect. Changing the ID is not required to ensure security. Changing the password is.

The ID is "confidential" from an Information Security standpoint, much like a Credit Card number. As with a Credit Card, it is something that others may know (such as your waitress or the staff in Central) which is why it is displayed on the Logon screen for all systems. We know the User ID. You know the User ID.

We have not seen a demand from customers up until now to for customers to be able to change their ID more than once. If that is changing we can consider if for a future release, depending on the Product side and how important they see it relative the benefit to customers.

The Password, however, is an entirely different matter and is considered "Highly Restricted" in the US or "Top Secret" from a Information Security aspect. You know your Password, but we do not. We do not store your password, we store the Hash of your Password. When you logon we compare the Hash of what you have entered in the Password field to the Hash stored. What is most important here is that it is not possible to derive the Password from the Hash. That is what Hashing algorithms are about. It is sometimes called 1-way Encryption, incorrectly. It is Hashing.

We do encourage customers to change their Passwords periodically. We ensure that Passwords are "strong", i.e. "statistically improbably" to guess. The Password is not displayed on the Logon screen as you type it, it is masked with asterisk

So in summary, we do not encourage customers to change their ID and in general it is not key to the security of your account. However, changing your password IS essential periodically.

I am not going to answer any rantings from Mr Chandler as in the past he has not actually taken the time to read my posts and just reacts with blind negativity. If anybody else has specific questions please post or PM me and I will get back to you from my Bank email ID. Thanks

Ian

Edited January 16, 2011 by ianguygil

[Pib]

Deleted...part of the post didn't post. Must retype back in.

Edited January 16, 2011 by Pib

[ianguygil]

Deleted...part of the post didn't post. Must retype back in.

Had to type mine more than once also

[jfchandler]

Ian, I as a customer of your bank, had a good personal reason for wanting to change my user ID...

Your bank has a procedure for doing so, as Pib cited in the bank FAQ above. Unfortunately, multiple of your bank staff didn't even know how to properly execute their own procedures to accomplish that task, a pretty simple one at that.

So your response is to launch a personal tirade against me, a bank customer.

Perhaps your time and attention would be better spent ensuring that your bank's staff know how to correctly conduct their own business...because...obviously they don't.

But then again, that's obviously not a point you'd care to have anyone focus on.

[lopburi3]

If the original ID is numeric and you are expected to change to what you want I can see a security reason to not allow another change (by a third party gaining access and locking you out of your account while he drains it).

[jfchandler]

Lopburi, if an unauthorized party was able to gain access to your online banking account (and they'd need your user ID and password to do it), they'd still be able to lock you out if they wanted to by changing just the password, which is easily done in the settings menu. So I'm not sure that argument goes very far...

But again, that's a side point... The point underlying all this is the bank has an established procedure for customers to change their user IDs... And because the bank staff didn't know their own procedures, they ended up wasting literally hours of a customer's time on what should have been a 5 minute task.

If the original ID is numeric and you are expected to change to what you want I can see a security reason to not allow another change (by a third party gaining access and locking you out of your account while he drains it).

Edited January 16, 2011 by jfchandler

[TimTang]

Ian

Hi Ian,

I posted earlier that I had applied for online banking but never received one of the two necessary items to log in. I can't remember if it was the ID or the password.

Someone mentioned that you can do this on the ATM.

Is this true? and if so how do I do it, or where do I find the instructions to do so?

Thanks in advance for any assistance you can provide.

Edited January 16, 2011 by TimTang

[Pib]

Deleted...part of the post didn't post. Must retype back in.

Had to type mine more than once also

Yea, somethng squirrelly was going on with ThaiVisa. Then I got a phone call before I could re-enter my post before the edit period ran out.

Anyway, what I almost said in my aborted post was I was very glad to change my User ID to an aphanumeric combination "I could easily remember" compared to the originally issued randomly generated (and long) digit number. Kinda like changing your ATM PIN to something you can remember. This way I don't have to write down the User ID that all the security experts tell you not to do. I know a person can use software or fingerprint scanner modules that encryt/store your User ID and password and throws your User ID/password into the logon screen automatically, but some of this User ID/password software don't work properly on some logon screens, especially the multiple screen logons...so you end up having to manually type the info in "if you can remember it." If you can't remember it, what do you do? Answer is: you pull out your little black book where you wrote down your super secret logon info. And some people like to use the same User ID for various logons/accounts (less to remember, less to write down), but hopefully they are also using different passwords in case an account gets hacked and the hacker knows you use the same User ID/password on numerous accounts/logons.

By havinging the capability to change your User ID "and" password periodically I would think it would add a little more security and allow the customer to create and change periodically a User ID he can easily remember withot having to write it down somewhere. Bangkok Bank is the only bank/financal account I have that don't allow online User ID changes as desired. If in the future Bankgok Bank does allow User IDs to be changed online whenever the customer desires, I would just recommend the change forces the customer to enter a User ID of a cetain minimum length comprised of a least letters and numbers to prevent the customer from just entering his name or some other too easy to remember nickname like Pib, Bubba, etc.

No doubt there are security pro's and con's against allowing User ID changes as desired, but it seems those banks that don't are in the minority now days....so does that mean those banks that are in the minority have stronger or weaker User ID/password procedures? I don't know. Time for Chang Beer and to post this before ThaiVisa starts acting squirrely again and I lose the post. Cheers

[jfchandler]

Following on Pib's comments above, Ian's comments earlier on online banking security, as might be expected, looked at the issue entirely from security inside the bank, what the bank staff know (your ID) and what they don't know (your password), etc etc..

But what that fails to consider is the big wide world outside the bank where people, some pretty unsophisticated, with online banking accounts do all kinds of things. (And in this, I'm not talking about my own activity, but rather, things the public in general often do).

--Because they have a hard time remembering all their different online IDs and passwords, they write them down on paper somewhere or even post sticky notes on their PC monitor, where they can be viewed or stolen by others.

--they store IDs and passwords in various electronic forms on their desktop and laptop computers that, if stolen or accessed by others, could allow them to gain access to that info.

--they use public internet cafes and/or wireless hotspots where thru various means such as keylogging or wifi sniffing their keystrokes in logging onto places can be captured.

--they get various kinds of malware on their computers that likewise can expose their personal information to others.

For all of the above reasons and others, particularly when it comes to bank account security, I think it's pretty reasonable that banks know their customers will and should want to change their user IDs and passwords from time to time... for all kinds of different reasons.

At least, after finally solving the issue after several hours of futility with other bank staff, the BKK Bank online banking supervisor who was my last point of contact had the good grace to apologize for all the prior folks who were clueless and sent me on a long runaround... I guess that kind of response would be too much to expect from Ian...

[lopburi3]

Be aware you can not set up internet banking using an ATM if it is a joint account.

[ianguygil]

Deleted...part of the post didn't post. Must retype back in.

Had to type mine more than once also

Yea, somethng squirrelly was going on with ThaiVisa. Then I got a phone call before I could re-enter my post before the edit period ran out.

Anyway, what I almost said in my aborted post was I was very glad to change my User ID to an aphanumeric combination "I could easily remember" compared to the originally issued randomly generated (and long) digit number. Kinda like changing your ATM PIN to something you can remember. This way I don't have to write down the User ID that all the security experts tell you not to do. I know a person can use software or fingerprint scanner modules that encryt/store your User ID and password and throws your User ID/password into the logon screen automatically, but some of this User ID/password software don't work properly on some logon screens, especially the multiple screen logons...so you end up having to manually type the info in "if you can remember it." If you can't remember it, what do you do? Answer is: you pull out your little black book where you wrote down your super secret logon info. And some people like to use the same User ID for various logons/accounts (less to remember, less to write down), but hopefully they are also using different passwords in case an account gets hacked and the hacker knows you use the same User ID/password on numerous accounts/logons.

By havinging the capability to change your User ID "and" password periodically I would think it would add a little more security and allow the customer to create and change periodically a User ID he can easily remember withot having to write it down somewhere. Bangkok Bank is the only bank/financal account I have that don't allow online User ID changes as desired. If in the future Bankgok Bank does allow User IDs to be changed online whenever the customer desires, I would just recommend the change forces the customer to enter a User ID of a cetain minimum length comprised of a least letters and numbers to prevent the customer from just entering his name or some other too easy to remember nickname like Pib, Bubba, etc.

No doubt there are security pro's and con's against allowing User ID changes as desired, but it seems those banks that don't are in the minority now days....so does that mean those banks that are in the minority have stronger or weaker User ID/password procedures? I don't know. Time for Chang Beer and to post this before ThaiVisa starts acting squirrely again and I lose the post. Cheers

The most serious problem you can have if somebody knows your ID is a Denial Of Service - DOS - problem whereby they deliberately lock your account. That is why we request customers to change their Bank issued numeric ID to a personally chosen unique ID which is much more difficult to post. I agree that now I have seen that several would like this ability I should raise it to the business partner to ask them to consider.

As I have offered many times, if any poster is having a problem with any of our services and you are unable to resolve it via the normal channels (yes, even you Mr Chandler) please contact me via PM and I will see what I can do. I get many requests per month this way. As long as I do not become the first tier support on this - i.e. you try with our branches or call center first - I will see what I can do to help, and normally I can.

Ian

[TimTang]

This may be a little OT but since you're on the forum I would like to utilize your expertise in banking while I can.

I'm wondering if you can explain the logic behind the governments restriction on paying interest to the bank accounts of foreigners.

This seems to me like a disastrously stupid financial decision. Imagine how many rich foreign retirees and business people that maintain the absolute minimum of savings and investments in the country due to this practice.

In most countries this would be considered discrimination. Isn't the main purpose of a bank to attract as much money as they possibly can regardless of the source? How does this help?

Just curious!

Edited January 16, 2011 by TimTang

[jfchandler]

Thank you for that kind offer, Ian...

Next time, if I can't get satisfaction after dealing with the first 5 BKK Bank staffers, I'll make sure you'll be the 6th person I'll call...

[Pib]

This may be a little OT but since you're on the forum I would like to utilize your expertise in banking while I can.

I'm wondering if you can explain the logic behind the governments restriction on paying interest to the bank accounts of foreigners.

This seems to me like a disastrously stupid financial decision. Imagine how many rich foreign retirees and business people that maintain the absolute minimum of savings and investments in the country due to this practice.

In most countries this would be considered discrimination. Isn't the main purpose of a bank to attract as much money as they possibly can regardless of the source? How does this help?

Just curious!

I'm a farang and get interest on my Thai bank accounts.

[TimTang]

I'm a farang and get interest on my Thai bank accounts.

Well I haven't been to the bank for a while but the last time I looked at the interest display panel it showed a big fat goose egg for foreigners.

Maybe that's changed. Has it?

[jfchandler]

And since we're on the subject of bank security, I should add that most of the U.S. banks I deal with have long since gone beyond the mere two factor log-in process of providing a user ID and password...

In almost all of my other banking relationships, the banks now require account holders to select a series of three or four personal answers and questions (selected by the account holder online). And then each time the person logs on from anywhere, unless they've already chosen to designate that particular computer as secure, they're asked to answer a rotating (it changes each time) security question as part of the log-on process...

And because the questions and answers are personal ones typically known only to the account holder (like the color of your first car or the street where you grew up or your grandfather's first name), the account holder usually wouldn't have the need to write down or otherwise store that kind of information. Nor would it typically be known by anyone else who might have been able to steal their bank user ID and password.

In addition, a lot of the banks have taken the additional step of instituting what I believe are called site certificates, where the account holder also has to pick a personal image and phrase that shows up every time they go to log-on to their bank's web site. By doing so, I gather, the purpose is to help avoid people being conned into entering their user ID and password at phishing web sites fraudulently made to look like the real bank's web site... such as when fraudsters send out fraudulent emails warning that the customer's account has been frozen and they need to enter their info (on a fake website) to unlock it... The scams are endless.

I don't know if those two additional security methods are the best ones available in the world's banking industry. But having those additional security measures certainly would seem to provide a higher level of accountholder security than just the ID/password combo.

Unfortunately, none of the Thai bank online banking setups I'm familiar with have implemented those kinds of additional measures as yet...

[Pib]

I'm a farang and get interest on my Thai bank accounts.

Well I haven't been to the bank for a while but the last time I looked at the interest display panel it showed a big fat goose egg for foreigners.

Maybe that's changed. Has it?

I been drawing interest on the two Bangkok Bank accounts for years. Once account is about 5 years old and is a joint account (me and the Thai wife). And the other account is in my name only and I've had it about 2 years.

[Tywais]

Well I haven't been to the bank for a while but the last time I looked at the interest display panel it showed a big fat goose egg for foreigners.

Maybe that's changed. Has it?

I've been getting interest for many years now. At one point in time as much as 12% annual and one bank offered 14%. Ah, the good old days. I have seen some mention on some bank websites a distinction between resident and non-resident but that would be individual banking policies and not government policy.

[jfchandler]

Tywais, re the bank interest, I've always been confused about that...seeing the different versions of postings here on TV... Some people say they get Thai bank interest.... Some people complain they don't...

Here's what the BKK Bank web site says re their savings accounts:

Savings Account

With a Bangkok Bank savings account, your interest is calculated everyday and deposited every six months.

Of course, the current savings account interest rate is 0.625% APY.. So I suppose it's possible some folks are in fact getting interest, but it's just too small and too infrequent for them to notice.

[Pib]

Tywais, re the bank interest, I've always been confused about that...seeing the different versions of postings here on TV... Some people say they get Thai bank interest.... Some people complain they don't...

Here's what the BKK Bank web site says re their savings accounts:

Savings Account

With a Bangkok Bank savings account, your interest is calculated everyday and deposited every six months.

Of course, the current savings account interest rate is 0.625% APY.. So I suppose it's possible some folks are in fact getting interest, but it's just too small and too infrequent for them to notice.

Yeap, interest gets posted to my accounts in mid June and mid December.

I've read somewhere (probably a ThaiVisa post that may not have been right) that a person can also select a quarterly or yearly interest payment in lieu of a semi-annual payment, but I'm not sure about this and don't see anywhere on the Bangkok Bank web site which talks quarterly/annual interest payments....only the twice a year payments.

All I can undoubtly say is I get my interest payments twice a year...one in mid June and one in mid December.

Edited January 16, 2011 by Pib

[Tywais]

Of course, the current savings account interest rate is 0.625% APY.. So I suppose it's possible some folks are in fact getting interest, but it's just too small and too infrequent for them to notice.

I was thinking the same thing.

[TimTang]

Now I'm confused. I've had my account for more than 12 years and I keep my passbook up date. I've yet to see a single INT deposit. Maybe I'm doing something wrong.

People on a retirement visa have to show a bank balance of 800,000 for three months. The most common complaint from them is "why should I maintain a balance of 800,000 in a Thai bank when it won't earn any interest?".

Most retirees transfer the money into their Thai bank account 3 months prior to their visa extension. Then transfer it back to their home country immediately after receiving their extension.

If foreigners earn interest then they are wasting time, energy, and money with this hassle of multiple transfers.

Maybe I should inquire at my bank, it seems strange that some foreigners are getting interest but others aren't.

[Pib]

Well I haven't been to the bank for a while but the last time I looked at the interest display panel it showed a big fat goose egg for foreigners.

Maybe that's changed. Has it?

I've been getting interest for many years now. At one point in time as much as 12% annual and one bank offered 14%. Ah, the good old days. I have seen some mention on some bank websites a distinction between resident and non-resident but that would be individual banking policies and not government policy.

There could be something to the resident and non-resident thing, as to whether you are staying on a long term visa/extension of stay or a person opening an account on a tourist visa and only in Thailand a few months out of the year. I'm on a retirement extension of stay. I remember when signing up for the second account the Bangkok Bank rep entering the new account info into the computer noticed she had entered an incorrect code, mentioned it to me and said it will take her about a minute to correct...and she also mentioned it was a code having something to do with whether I was living in Thailand or just a visitor. I didn't ask anything beyond that as it was just some chit-chat occurring between the customer rep and the customer in doing a transaction. I expect the interest paying policy may vary from bank to bank depending on different things.

Edited January 16, 2011 by Pib

[TimTang]

I was transfered to Singapore for a couple of years and while there I opened a HSBC account, but I still maintained my Bangkok Bank account because I knew I would be coming back.

When I was transfered back I thought I would transfer my HSBC account and close my BKKB account because it doesn't earn interest any way.

They told my I would have to close my Singapore account and open a new HSBC account in Thailand because the regulations were different. When I got here I found that you needed to have a minimum $20,000 US in order to have a interest earning foreigner account, so I gave up on that Idea and just maintained my BKKB account.

So foreigners earning interest is quite a revelation to me. Obviously SOMETHING must have changed that I'm not aware of.

Can anyone clarify?

Edited January 16, 2011 by TimTang

[Pib]

Of course, the current savings account interest rate is 0.625% APY.. So I suppose it's possible some folks are in fact getting interest, but it's just too small and too infrequent for them to notice.

I was thinking the same thing.

I'll take that 0.625%...it still beats a lot of US banks. For exampe Bank of America Money Market Savings Account interest rate is only 0.1% up to $5000; 0.3% for the $10K to 25K range...even their over $2.5M rate is only 0.45%. Heck, even USAA that some of us keep talking about favorably only pays 0.55%. Of course these generally low US bank savings rates is due to the US Federal Reserve having federal interest rates close to 0% compared to Thailand Bank of Thailand being around 2%. Another reason to have multiple bank accounts, so you have more chances/choices in keeping the bulk of your cash funds in the account paying the highest interest rate...and BofA which I still have an account for some backup online banking purposes definitely don't have the bulk of my cash savings...only the minimum to avoid monthly account maintenance fees.

Edited January 16, 2011 by Pib

[Pib]

I was transfered to Singapore for a couple of years and while there I opened a HSBC account, but I still maintained my Bangkok Bank account because I knew I would be coming back.

When I was transfered back I thought I would transfer my HSBC account and close my BKKB account because it doesn't earn interest any way.

They told my I would have to close my Singapore account and open a new HSBC account in Thailand because the regulations were different. When I got here I found that you needed to have a minimum $20,000 US in order to have a interest earning foreigner account, so I gave up on that Idea and just maintained my BKKB account.

So foreigners earning interest is quite a revelation to me. Obviously SOMETHING must have changed that I'm not aware of.

Can anyone clarify?

It could be a minimum amount thing, but I don't think so, at least for my Bangkok Bank accounts as I only keep an average of around $5000 worth of baht (150,000 Baht) in my two Bankgok Bank accounts....transfer more in periodically as needed to maintain that average amount....and I may lower that average amount once I get a US debt card that doesn't charge a foreign transaction fee (I'm working on that...hopefully it's in the mail). But I also know I was getting interest payments on one account when it just had a couple thousand baht in it for about 9 months.

[ianguygil]

This may be a little OT but since you're on the forum I would like to utilize your expertise in banking while I can.

I'm wondering if you can explain the logic behind the governments restriction on paying interest to the bank accounts of foreigners.

This seems to me like a disastrously stupid financial decision. Imagine how many rich foreign retirees and business people that maintain the absolute minimum of savings and investments in the country due to this practice.

In most countries this would be considered discrimination. Isn't the main purpose of a bank to attract as much money as they possibly can regardless of the source? How does this help?

Just curious!

I think this is something to do with central bank regulations so I really cannot comment. Thanks

Edited January 16, 2011 by ianguygil

[ianguygil]

Well I haven't been to the bank for a while but the last time I looked at the interest display panel it showed a big fat goose egg for foreigners.

Maybe that's changed. Has it?

I've been getting interest for many years now. At one point in time as much as 12% annual and one bank offered 14%. Ah, the good old days. I have seen some mention on some bank websites a distinction between resident and non-resident but that would be individual banking policies and not government policy.

There could be something to the resident and non-resident thing, as to whether you are staying on a long term visa/extension of stay or a person opening an account on a tourist visa and only in Thailand a few months out of the year. I'm on a retirement extension of stay. I remember when signing up for the second account the Bangkok Bank rep entering the new account info into the computer noticed she had entered an incorrect code, mentioned it to me and said it will take her about a minute to correct...and she also mentioned it was a code having something to do with whether I was living in Thailand or just a visitor. I didn't ask anything beyond that as it was just some chit-chat occurring between the customer rep and the customer in doing a transaction. I expect the interest paying policy may vary from bank to bank depending on different things.

Exactly, PIB, I think this is something to do with differentiating interest between what is considered to be "hot money" of non residents having THB accounts and local account holders. I do not have the details on this but it is consistent across all banks based on the status of the account holder.

Edited January 16, 2011 by ianguygil

[ianguygil]

And since we're on the subject of bank security, I should add that most of the U.S. banks I deal with have long since gone beyond the mere two factor log-in process of providing a user ID and password...

In almost all of my other banking relationships, the banks now require account holders to select a series of three or four personal answers and questions (selected by the account holder online). And then each time the person logs on from anywhere, unless they've already chosen to designate that particular computer as secure, they're asked to answer a rotating (it changes each time) security question as part of the log-on process...

And because the questions and answers are personal ones typically known only to the account holder (like the color of your first car or the street where you grew up or your grandfather's first name), the account holder usually wouldn't have the need to write down or otherwise store that kind of information. Nor would it typically be known by anyone else who might have been able to steal their bank user ID and password.

In addition, a lot of the banks have taken the additional step of instituting what I believe are called site certificates, where the account holder also has to pick a personal image and phrase that shows up every time they go to log-on to their bank's web site. By doing so, I gather, the purpose is to help avoid people being conned into entering their user ID and password at phishing web sites fraudulently made to look like the real bank's web site... such as when fraudsters send out fraudulent emails warning that the customer's account has been frozen and they need to enter their info (on a fake website) to unlock it... The scams are endless.

I don't know if those two additional security methods are the best ones available in the world's banking industry. But having those additional security measures certainly would seem to provide a higher level of accountholder security than just the ID/password combo.

Unfortunately, none of the Thai bank online banking setups I'm familiar with have implemented those kinds of additional measures as yet...

ID and Password is 1 Factor Authentication. It is "What you know"

All of these are questions you list are 1 Factor Authentication. 1 x 1 x 1 = 1. They are all based on "what you know" and are no protection against threats like Trojans.

We already employ SMS out of band Authentication for highly sensitive transactions. This is "What you have". Add that to "What you know" and you have 2 Factor Authentication. We offer Tokens for Business and Corporates and most consumers push back against each bank offering them a token, which is why we use the SMS.

Site Certificates are not what you described and are nothing to do with authentication of the customer to the Bank. They authenticate the site to the customer. We have an Verisign Site Certificate, check your browser when you access iBanking. In fact this is the only way we can offer strong SSL offshore from the USA.

The thing you describe does provide limited protection against Phishing but is totally ineffective against Trojans, man-in-the-middle attacks etc.

We do not divulge what we do to prevent Phishing. That would be silly.

This is a moving target as you said and it takes a lot of our time and resources, and progressively the banks in Thailand, regionally and internationally are working together.

It really does make me smile to see a "reporter" state his view of the security world. Excellent research.... Impressive.

Edited January 16, 2011 by ianguygil

[jfchandler]

Ian, you blithely dismiss the personal questions process as being ineffective against trojans..that may be...

But I'd say they are effective against the broader threat of people's password and user id being compromised due to the various bad/unsafe computing practices I listed above. In part because the question you're asked and must answer this time is not the same question and answer you'll get next time, and because users don't need to write down or otherwise record those answers in order to remember them, unlike IDs and passwords, which removes a whole layer of risk.

Of course, I guess I'm being presumptious to think that a security safeguard that's been widely implemented throughout the entire U.S. banking industry...and in corporate and government sectors as well -- is something that might have some value... since Bangkok Bank hasn't done anything comparable to protect its user log-in process...

When I worked in government (apart from my time in the news media), our network adminstration required us to regularly change both our log-in user IDs and our passwords, across the entire many thousands of workers enterprise... And we couldn't even go back and use a previously used ID and password...it had to be new every time thru at least four or five cycles... BKK Bank, of course, never requires its customers to change their passwords or IDs.

I'm sure Bangkok Bank knows better, and is more secure with its limited rudimentary measures, than everyone else that's already adopted those additional security measures.