Account Holders Say Money Taken From SCB Accounts: Cyber Crime

[webfact]

Account holders say money taken from SCB accounts

Pongphon Sarnsamak

The Nation

BANGKOK: -- Six people lodged complaints at Siam Commercial Bank (SCB) headquarters yesterday, claiming that money had disappeared from their bank accounts. The victims suspect cyber-crimes.

"Before Bt50,000 disappeared from my account, someone called me to say that the bank would need to delete my bank account because it was infected with a virus," one of the victims said.

Chontida Siriphanthong, 34, said she suspected foul play when she received that call early this month.

"I did not believe him at first. But after I had tried to log in to access the online banking service by using my existing username, I found that I could not sign in with my current username," she said.

Other victims faced a similar fate. They used some online banking services, and found later that money was missing. Another victim said she lost Bt100,000.

SCB yesterday assured the victims that it would look into the complaints and reply within one week.

"I don't know how these cyber crooks hacked my bank account and stole my money. I just want my money back," Chontida said.

She said when she first found out about the missing money on June 10, she immediately contacted the bank's call centre to report the incident.

She said she also checked on her own where her Bt50,000 was transferred to and found that it was transferred to a Bangkok Bank account.

Chontida, who is unemployed, made several phone calls to contact call centres for the two banks and asked for assistance to get her money back.

Bangkok Bank staff informed her that her money was transferred to a Bangkok Bank account at Central Festival's Pattaya branch, owned by a Khon Kaen woman.

Bank staff had called the owner of this account and asked her to return Bt50,000 back to Chontida, if this amount of money did not belong to her. The owner of the Bangkok Bank account informed the bank staff that she had nothing to do with Chontida's money. She said she did not hold the passbook or ATM card. Her ex-husband, who is a foreigner, had taken these things. After that, bank staff could no longer contact her.

Earlier this month, Chontida lodged a complaint with the Technology Crime Suppression Division (TCSD) against SCB and Bangkok Bank and asked police to help her to find the wrongdoers and get her money back.

-- The Nation 2012-06-26

[ripstanley]

http://www.scb.co.th/en/about-scb/phishing-mail

The SCB has this warning on their website. It is quite detailed and all customers should read.

[borisloosebrain]

Hey try citibank for some fun I was hacked then accused of stealing my own $- cops didn't care, bank didn't care - after 6 months I finally got some help and retrieved my BAHT.1,500,000 after threatening to expose them to the media....it was the Singapore cops who found the culprits.....the thai cops couldn't careless....thanks u useles thonglor bibs and genuinel thanks to my friends and cousin in the media.

[hansgruber]

Most of these crimes are inside jobs.

Staff sells info to crims and that's how they gain access. Proven many times in the past but its always hushed up.

I once was in the process of buying a condo in Bangkok back in 2005 from a major developer.

I was waiting for my money to transfer from my home country which took 2 days. Funny thing was, the morning my money had arrived in my scb account, the lawyer (Provided by the developer) handling the process called me to say that my money just arrived to Thailand. How did she know??? I marched down to to ratchyothin hq and they found that someone in that office had accessed my account at 8.30am so they found out the leak and the employee responsible. No privacy whatsoever so I switched to kasikorn.

[chotthee]

http://www.scb.co.th...b/phishing-mail

The SCB has this warning on their website. It is quite detailed and all customers should read.

I read all these stuff in details before I click yes.

[falang07]

Hacked? The stupid girl just told them the login and password, they have changed it, transferred money to Bangkok Bank and that is all the "hacking", just pure stupidity. I wonder why they provide internet banking to people who did not finish more than 6 years of a basic school.

[woodyleonhard]

Phuket Gazette Live Wire from last month:

http://www.phuketgazette.net/archives/articles/2012/article16021.html

I've seen many more SCB phishing emails recently. It looks to me like a list of SCB customers has leaked.

[Buchholz]

Bangkok Bank staff informed her that her money was transferred to a Bangkok Bank account at Central Festival's Pattaya branch, owned by a Khon Kaen woman.

Bank staff had called the owner of this account and asked her to return Bt50,000 back to Chontida, if this amount of money did not belong to her. The owner of the Bangkok Bank account informed the bank staff that she had nothing to do with Chontida's money.

She said she did not hold the passbook or ATM card. Her ex-husband, who is a foreigner, had taken these things.

It's those dam_n foreigners again...

.

Edited June 26, 2012 by Buchholz

[Scott]

I have 3 bank accounts with 3 different banks, mainly due to the employer changing banks for depositing our pay. I've received emails from all of them that had to be bogus. I have never opened any of the emails or attachments because I have NEVER given my email address to any bank!

My question is how on earth does someone get my email address?

[how241]

http://www.scb.co.th...b/phishing-mail

The SCB has this warning on their website. It is quite detailed and all customers should read.

Thanks for that.

[Thaddeus]

Phuket Gazette Live Wire from last month:

http://www.phuketgaz...ticle16021.html

I've seen many more SCB phishing emails recently. It looks to me like a list of SCB customers has leaked.

I get emails claiming to be from SCB on a regular basis.

I have never had an account with them.

[PattayaParent]

I know someone that this has happened to at Bangkok Bank and it has previously happened to me at Thai Farmer's.

Nothing new but it seems to be the first time it's been reported in the press.

[ronthai]

Never click on any links that is not the URL of your bank or emails from "your" bank.

If you need to login always do it through the official website which you can bookmark in your browser.

Use a virus checker and update daily (Norton, AVG, Kaspery)

If you are not good with computers, do not do internet banking.

Last but not least: READ, Look at the URL, Hover your mouse over any link and you will see the link at the bottom of your browser.

[Brian Walker]

What I do not get, is now with scb bank, and most banks in Thailand, you need the SMS activation code to add an account for transfer, then you need SMS code to transfer.

With scb, you need to go to the branch to change the mobile number.

Obviously this is a scam with the account holder, and individual, or somebody in the call center has transferred the money and not online.

Or the account holder could of lost his/her phone with his/her scb account login details stored in the phone memory, if this is the case then the bank cannot be held liable, because you have stored your login details, which anyone can gain access to.

I'll let the fellow board members decide

[MikeThaison]

"Bank staff had called the owner of this account and asked her to return Bt50,000 back to Chontida, if this amount of money did not belong to her. The owner of the Bangkok Bank account informed the bank staff that she had nothing to do with Chontida's money. She said she did not hold the passbook or ATM card. Her ex-husband, who is a foreigner, had taken these things. After that, bank staff could no longer contact her."

Can anyone see the problem with this? Ridiculous thought process. Let's call the crook up and ask nicely to return the money. *FACEPALM*

[crazykopite]

Thai lady unemployed with more than 50,000 bht in her account !!!!

[jomtienbob]

Most of these crimes are inside jobs.

Staff sells info to crims and that's how they gain access. Proven many times in the past but its always hushed up.

I once was in the process of buying a condo in Bangkok back in 2005 from a major developer.

I was waiting for my money to transfer from my home country which took 2 days. Funny thing was, the morning my money had arrived in my scb account, the lawyer (Provided by the developer) handling the process called me to say that my money just arrived to Thailand. How did she know??? I marched down to to ratchyothin hq and they found that someone in that office had accessed my account at 8.30am so they found out the leak and the employee responsible. No privacy whatsoever so I switched to kasikorn.

About 10 years ago I lost my Bangkok Bank ATM card late on a Sunday evening. Fearing not, I thought OK I will just go to the branch tomorrow and sort it out. I was working that morning, so I went up to the Jomtien branch at lunchtime where the teller advised me that someone had withdrawn ALL the money out of the account at 9:30 that morning. She eventually told me the ATM that the withdrawal took place at (2nd rd south pattaya) and advised me I need to make a police report, however it would take the bank 30 days to issue me a copy of the transaction as it had to come from head office. So I went to the police and the branch where the withdrawal occurred and the police issued a written request to receive a copy of the ATM surveillance Video. The local manager evaded my appointment request accompanied by the police for weeks with all sorts of excuses, and eventually refused the police request for the video citing that only head office in BKK could approve that.

So after 6 weeks the branch eventually relented to the 3rd written request from the police by only allowing us to view the tape at their premises. The manager did not allow us to look at any of the rest of the tape, only a short 30 second clip they said was video of me withdrawing the money. When I challenged that due to the time on the tape and the time on the transaction being some 25 minutes different the manager said the time on the camera and the time on the computer aren't the same. I noted the other problem being also that the guy on the tape was some 20-30cm taller than me also. No this was you spruced the bank staff! But I had an ironclad Alibi being at work I said! No, case closed good bye to you and your measly 35,000 baht waved the bank staff. The police had given up and couldn't care less and the Bank staff were CLEARLY on the inside of that one, so I retreated with not knowing what to do but knowing that there had to have been some collusion from insiders to get the pin or to change the pin. Too much like hard work for these cops, and I thought I could be getting some visits from not so friendly bank associates if I made much more of it, but YES for sure you can guarantee that the Bank had no intention of supporting its customer (me) as otherwise it might be THEIR money at risk....

There is NO real security here, so be warned and careful. Changing Banks doesn't necessarily solve this either, it's their blind myopic approach to problems that is the real dilemma and it won't change soon I guess.

[RichardinBKK]

What I do not get, is now with scb bank, and most banks in Thailand, you need the SMS activation code to add an account for transfer, then you need SMS code to transfer.

With scb, you need to go to the branch to change the mobile number.

Obviously this is a scam with the account holder, and individual, or somebody in the call center has transferred the money and not online.

Or the account holder could of lost his/her phone with his/her scb account login details stored in the phone memory, if this is the case then the bank cannot be held liable, because you have stored your login details, which anyone can gain access to.

I'll let the fellow board members decide

BINGO! Yes, you nailed that one. To move money, you need to either receive and SMS or Email confirmation code that expires in 10 minutes. You see, the trick is for "Smart Phone" users .. is to be smarter than a phone. If you lose it and are linked to your bank, your email, etc...you may as well stand on the corner handing out 1,000 B notes all day.

Some will say, "i did not lose my phone." True, but did you get a 2 hour massage lately? Accept your real estate agent's generous offer to spend some "quality time" at his favorite .... ummmmm... "therapist?" Leave your phone in you bag while out at a club? Etc? They only need it for 15 minutes to do the dirty deed. I carry a "stupid phone" All it does it make calls, take pictures and play music. No email, no personal data, no GPS tracking embedded (Yes folks, simply by clicking a few buttons on your IPhone, you can be tracked as long as it has power...) Did you know, for example, that if you have a Google+ account and set up your phone too quickly, every picture you take can be linked, published with no way to delete them? Stupid me with my stupid phone...it does what i need and protects my privacy.

As to the "inside job" theory. Really? If you were working in a bank, and knew you could rot in a Thai prison, would you risk it for 50,000B? 50,000,000 perhaps. And there are plenty of accounts at these banks with at least 30,000,000 B in them. I think the only inside job here is what goes on behind some people's backs while they are busy ... "inside.'

Food for thought.

Kudos to you for pointing out this detail...really changes the complexion of the story.

[theajarn]

Big <deleted> ~LOL~

The idiot, being an idiot, failed in so many ways. First, she hasn't a clue about viruses, next, she hasn't a clue how banks and privacy statements work, then she obviously fails to read what the bansk have been warning about since time immemorial and finally, she thinks it's the bank's fault -- despite the fact that they DO warn people about these things.

Sorry, but fools like this well... don't deserve to be handling that amount of money. I'm sure it's in much safer hands now.

On the other hand, this is exactly why we need better IT education in schools -- not just in Thailand, but the world over -- this stuff happens a lot elsewhere too. I'm surprised it hadn't hit here sooner. The Khon-khaen woman was obviously paid for her part -- and the foreigner -- if it is indeed a foreign would have been wise to have left the country already.

Banks are smart against this too -- aside from the warnings they already have, they have this in their fine print: if you're an idiot and lose your money, it's your fault. Part of the stuff that appears just before the "I agree" button. Banks simply cannot risk losing money to idiots who aren't careful with theirs -- could you imagine if this girl got hers back just like that -- could be a sham in itself.

Edited June 26, 2012 by theajarn

[RichardinBKK]

Most of these crimes are inside jobs.

Staff sells info to crims and that's how they gain access. Proven many times in the past but its always hushed up.

I once was in the process of buying a condo in Bangkok back in 2005 from a major developer.

I was waiting for my money to transfer from my home country which took 2 days. Funny thing was, the morning my money had arrived in my scb account, the lawyer (Provided by the developer) handling the process called me to say that my money just arrived to Thailand. How did she know??? I marched down to to ratchyothin hq and they found that someone in that office had accessed my account at 8.30am so they found out the leak and the employee responsible. No privacy whatsoever so I switched to kasikorn.

About 10 years ago I lost my Bangkok Bank ATM card late on a Sunday evening. Fearing not, I thought OK I will just go to the branch tomorrow and sort it out. I was working that morning, so I went up to the Jomtien branch at lunchtime where the teller advised me that someone had withdrawn ALL the money out of the account at 9:30 that morning. She eventually told me the ATM that the withdrawal took place at (2nd rd south pattaya) and advised me I need to make a police report, however it would take the bank 30 days to issue me a copy of the transaction as it had to come from head office. So I went to the police and the branch where the withdrawal occurred and the police issued a written request to receive a copy of the ATM surveillance Video. The local manager evaded my appointment request accompanied by the police for weeks with all sorts of excuses, and eventually refused the police request for the video citing that only head office in BKK could approve that.

So after 6 weeks the branch eventually relented to the 3rd written request from the police by only allowing us to view the tape at their premises. The manager did not allow us to look at any of the rest of the tape, only a short 30 second clip they said was video of me withdrawing the money. When I challenged that due to the time on the tape and the time on the transaction being some 25 minutes different the manager said the time on the camera and the time on the computer aren't the same. I noted the other problem being also that the guy on the tape was some 20-30cm taller than me also. No this was you spruced the bank staff! But I had an ironclad Alibi being at work I said! No, case closed good bye to you and your measly 35,000 baht waved the bank staff. The police had given up and couldn't care less and the Bank staff were CLEARLY on the inside of that one, so I retreated with not knowing what to do but knowing that there had to have been some collusion from insiders to get the pin or to change the pin. Too much like hard work for these cops, and I thought I could be getting some visits from not so friendly bank associates if I made much more of it, but YES for sure you can guarantee that the Bank had no intention of supporting its customer (me) as otherwise it might be THEIR money at risk....

There is NO real security here, so be warned and careful. Changing Banks doesn't necessarily solve this either, it's their blind myopic approach to problems that is the real dilemma and it won't change soon I guess.

If there is a "blind myopic" character in this story, look no further than the nearest mirror. Pretty simple my friend, no card in hand, no pin number (you only get thee tries), no lost funds. Your cryptic reference to "Late Sunday" may get some to wonder if you new "friend" (s?) gave you a helping hand on this age old scam. May I ask, as the evening at the bar ended, and you decided to retire for the evening, was there one last ATM stop to make? Ummmm .. mystery solved.

[David Barker]

I have 3 bank accounts with 3 different banks, mainly due to the employer changing banks for depositing our pay. I've received emails from all of them that had to be bogus. I have never opened any of the emails or attachments because I have NEVER given my email address to any bank!

My question is how on earth does someone get my email address?

They don´t, they send out thousands of emails at random if they get one reply. Its cash in the bank

[shunima]

I have 3 bank accounts with 3 different banks, mainly due to the employer changing banks for depositing our pay. I've received emails from all of them that had to be bogus. I have never opened any of the emails or attachments because I have NEVER given my email address to any bank!

My question is how on earth does someone get my email address?

My bank requires my address to verify an online transaction with a code sent to my eMail adress. This code is valid for a few minutes but they hold my eMail address now. Anyway, even if somebody can access my online banking they also require my eMail login to do some damage. On top they send me an SMS once the transaction is completed.

Most of the "hacking" is clueless people using unsecure passwords and do not change them for different login's. It's basically the good old "You pay for your stupid" rule that applies in most cases.

[TackyToo]

Hacked? The stupid girl just told them the login and password, they have changed it, transferred money to Bangkok Bank and that is all the "hacking", just pure stupidity. I wonder why they provide internet banking to people who did not finish more than 6 years of a basic school.

Here is what's happening next, they will tell these morons their property in a bank safe deposit is infected with antibiotics resistant gonorrhea and needs to be destroyed

[Scott]

I have 3 bank accounts with 3 different banks, mainly due to the employer changing banks for depositing our pay. I've received emails from all of them that had to be bogus. I have never opened any of the emails or attachments because I have NEVER given my email address to any bank!

My question is how on earth does someone get my email address?

They don´t, they send out thousands of emails at random if they get one reply. Its cash in the bank

I have only gotten emails which concern a bank where I have an account. I don't use internet banking, so I've never given them an email account. As a matter of fact, the oldest account was opened when I didn't even have an email address. The second one was opened when I was living in another country and using an email address through that country.

It's a bit unnerving that someone has managed to connect the right banks to me and no wrong banks.

[Reasonableman]

Perhaps you made an online booking, air ticket, accommodation, etc., with your credit card and left your e-mail address as the contact. 1 + 1 = you.

[belg]

after i got a virus on my pc, i just deactivated long time ago my online banking

here in thailand it was login and password only, no special calculator to verify your transactions

way to dangerous to use outdated technology and the risk of losing all your money

[animatic]

I have 3 bank accounts with 3 different banks, mainly due to the employer changing banks for depositing our pay. I've received emails from all of them that had to be bogus. I have never opened any of the emails or attachments because I have NEVER given my email address to any bank!

My question is how on earth does someone get my email address?

They target with bulk email and hope for a stupid person hit.

I get fishing emails from banks in 3-4 different countries,

because one of my emails has a uk tag I get fishing scams,

from banks I have never heard of in England and Scotland.

They also troll forums and other places and collect emails

and just add them to the troll lists,

which are sent out on compromised personal computers,

used as robotic proxies. And as noted above the look for transactions

online where there is a name and bank and email combined.

Edited June 26, 2012 by animatic

[esbkk]

Hi there -

This might be of interest to anyone doing internet banking: used by about 200 banks world wide.

A free download: http://www.trusteer.com/product/trusteer-rapport.

[samjaidee]

Thai lady unemployed with more than 50,000 bht in her account !!!!

Maybe she's been unemployed for a week and before that was earning more than you could ever imagine earning per month.

Why so negative? Get a Life!

[SouthernMan3]

Is this only if you use online banking ?