Money Stolen From Bank Account

[espionage33]

Hi guys,

Anybody has any experience with money being withdrawn from a Thai Bank Account mysteriously? I am the only person in this world who know my pin and I never lost my card before.

I have been using my Bangkok Bank account for 2 years and this is the first time such a thing happened. I called the bank and they said that a transaction was made from a ATM machine near my house. There was no records of wrong pin number entered. The bank insist that under such circumstances they will not be responsible.

I was thinking of reporting the police, but does that help at all?

Anybody have any suggestions?

Thanks.

[Georgie-Porgie]

I got pickpocketed in Bangkok several years ago. I deal with a lot of Thai businesses there, and am pretty friendly with the owners. They all told me to quickly cancel the card as the thieves usually have contacts inside the bank who will tell them the PIN number. I canceled mine right away.

[Guest chingy]

are you sure you weren't drunk and withdraw it yourself

[Roger13]

I have been using my Bangkok Bank account for 2 years and this is the first time such a thing happened. I called the bank and they said that a transaction was made from a ATM machine near my house. There was no records of wrong pin number entered. The bank insist that under such circumstances they will not be responsible.

Hi esp..

Do you normally use that machine?

Can you say how much is the Transaction you do not recognise?

Is it a single withdrawal or several?

Have you asked the Bank to Cancel your Current Card

and issue a new one?

OR - are you able to change the PIN at any machine?

Roger

[wolf5370]

A fairly well off Thai friend of mine once had about $10,000 'removed' from his account at his Thai Bank that his family all used. His uncle was actually the Branch Bank Manager. It turned out that his uncle - the bank manager - had been skimming accounts and had suddenly emptied several that belong to family. He thought they would not tell on him because it was family. They didn't, but the police investigated because of some kind of audit irregualrities some time later. My friend never got his money back as they protected their uncle, but he lost his job.

[elfe]

are you 100% sure that at the time of the withdrawal you were in possession of your card? the same thing happened to a friend of mine and she could not explain how it could have happened, even reported to the tourist police. Later her boyfriend admitted that while she was asleep he took the card and tried the number he once saw her typing in the atm before. So, first check your 'friends', sometimes it's (sadly) unbelievable.

[Up2U]

Slightly off-topic, but here is my tale of woe.

Asked my UK bank (old High Street Bank) to send new debit card to Thailand. They refused, as Thailand post is 'blacklisted' (their word). So I had it sent to my sister in UK, so that she could send it to me.

She never received it, but someone unknown did - and emptied my account by shopping at various supermarkets, etc. This card should not have been activated (only I have the PIN) but it was accepted all over London.

I have not received any compensation in the three years since this happened.

Regrettably I have too many standing orders and so on at the bank to be able to cancel the account until I go back to UK. But I will do so as soon as I visit !

It ain't just Thailand, all banks are scrambling for maximum profit and imposing umbrella systems that do not necessarily suit individual customers.

[taxexile]

my thai in-laws tell me to be careful with thai banks.

their codes of practice are not as good as those in europe, and judging by the laid back way the employees go about their work its not surprising that mistakes are made and money goes astray.and if the employees are sloppy in their practices then the managers must be as well.

the employees have access to pin numbers and account numbers etc. and some may be pressurised by family/friends etc. to dip into accounts, especially farang accounts that may be dormant for months on end whilst the farang is away.

telebanking with the bangkok bank involves inputting atm card numbers and the relevant pin numbers, divulging this combination of personal data is a high security risk if ever there was one.

i always keep my atm slips and get a transaction record from the bank every so often to check against atm slips. updating the book tells you nothing.

[think_too_mut]

>I called the bank and they said that a transaction was made from a ATM machine near my house.

That says it all - the card must had been phisically inserted into the ATM.

I read about a guy whose girlfriend did the same while he was asleep. The ATM took a picture of her while withdrawing.

If you insist, the bank can switch the flag on your account that a photo must be taken whenever your card is inserted. You or whoever brings the card to the machine would not know that.

[Roger13]

I really must question whether Bank Staff

can know PINs. PINs should only be known to the Computer.

And - I have witnessed many people in Bangkok

in front of ATMs with several Cards and looking at bits of paper.

Maybe they are transferring money to other accounts,

paying Bills etc - but I get the impression that some of them

are withdrawing cash for others.

Is it common practise for Thais to trust others

- maybe fellow workers - with their PINs?

Roger

[plachon]

I really must question whether Bank Staff

can know PINs. PINs should only be known to the Computer.

And - I have witnessed many people in Bangkok

in front of ATMs with several Cards and looking at bits of paper.

Maybe they are transferring money to other accounts,

paying Bills etc - but I get the impression that some of them

are withdrawing cash for others.

Is it common practise for Thais to trust others

- maybe fellow workers - with their PINs?

Roger

A few years ago it used to be common at the end of the month to see people in their factory/office clothes queuing up at the ATM with a handful of ATM cards and a list of scribbled PINS. That one "ATM literate person" would then attempt to withdraw the wages of everyone, but usually get all mixed up over which PIN went with which card and it would take forever, sometimes losing cards in the machine after too many attempts at the PIN number. And this was all based on trust by the ATM owners that Khun XYZ wouldn't try to rip them off and would deliver their wages. Incredible, but it doesn't seem so common these days. Funny that, wonder why?

[think_too_mut]

>A few years ago it used to be common at the end of the month to see people in their factory/office clothes queuing up at the ATM with a handful of ATM cards and a list of scribbled PINS.

It is still like that. Near my place in BKK there are several clothes factories. Not only on a pay day, almost always, I can see one woman with handful of cards, withdrawing cash for her coworkers.

From the family I learned how they do that: they chose their PIN to be "1234", absolutelly no secrecy.

[think_too_mut]

I really must question whether Bank Staff

can know PINs. PINs should only be known to the Computer.

As an ex-ATM software developer, I must say - PIN is known only to the computer. No way bank clerks can learn it. It's not stored on the card.

There are ways to learn it. For example, setting up a bougus ATM that would accept the card, ask (and record) for the PIN and display "unable to complete transaction" message and then return the card.

However, such an attempt would have left many people without their money and the Bank would know that.

(Getting an ATM is not impossible - when I worked for an ATM vendor we could buy one for 20$ at warehouse garage sale. Some people did, keep them in their garages as safe boxes)

The original poster should know what time the transaction had been made. Then it would be easier to either recall what happened or argue his way trough.

[Roger13]

As an ex-ATM software developer, I must say - PIN is known only to the computer. No way bank clerks can learn it. It's not stored on the card.

Hi TTM,

I must say I was under the *Impression* that PINs

were indeed coded within the Magnetic strip. So I am

interested to hear otherwise.

This therefore means that the PIN is not checked until

the ATM links up with the Computer of the Card Issuer ?

So if Communications are down, there is no Provision

for a nominal amount being dispensed?

I thought that below a certain figure you could get cash

by the ATM being able to check the PIN and the ATM's

Computer not having any detrimental / negative report

on the Card (Lost / Stolen etc). Or maybe some such

was in the past ...

Roger

[Zendesigner]

i went to the bank yesterday and needed to change in to a new account because i moved to a different place.

When i asked why they cannot use the old account i got the following explanation.

A branch of a thai bank can only handle it's own accounts because the bank manager has the power to sign , take out , ect money in all of the account of the bank. If they would make that nation wide , the risk of bank managers stealing is to great. ?????

Nice to hear that from your bank clerck no ?

And the farangs are the criminals in thailand ?????

B

[think_too_mut]

>I must say I was under the *Impression* that PINs

were indeed coded within the Magnetic strip. So I am

interested to hear otherwise.

No, the PIN is not stored on the card.

>This therefore means that the PIN is not checked until

the ATM links up with the Computer of the Card Issuer ?

The card inside the ATM contains your account number. Then, forms a data packet together with the PIN that you entered and sends the frame to the host (mainframe).

>So if Communications are down, there is no Provision

for a nominal amount being dispensed?

True. Link down - no money. The connection is redundant (two different paths), very reliable and there are always two ATM controller computers for redundancy. (Two computers at the main and two at the disaster recovery site, four altogether).

That's where former Tandem made their fortune.

However, you might be talking of cash dispensers (they are not ATMs). You can see them in pubs and bars.

Some banks may encode additional info on the card that will enable you to get, say, 20$ per week emergency money.

Those machines are just slightly bigger than cashe registers but I don't think we are talking about them here.

>I thought that below a certain figure you could get cash

by the ATM being able to check the PIN and the ATM's

Computer not having any detrimental / negative report

on the Card (Lost / Stolen etc). Or maybe some such

was in the past ...

ATM is nothing more than input/output device. Inside you can see a gutted Pentium PC.

What happens with your money is directed by your account properties and policies maintained by the bank and kept on their mainframe.

[huski]

She never received it, but someone unknown did - and emptied my account by shopping at various supermarkets, etc. This card should not have been activated (only I have the PIN) but it was accepted all over London.

dear up2u,

your card was already activated when it was sent because it sounds like it wasn't a visa or a mastercard. if it was an atm card, the bank should have required you to come in and physically accept it.

your card must have had purchasing rights at stores, thats why it didn't require a pin number. the signature on the receipts must have matched the signature the bastard signed the back of your card right after he stole it making the merchants think it was valid

Regrettably I have too many standing orders and so on at the bank to be able to cancel the account until I go back to UK. But I will do so as soon as I visit !

call the bank and have them cancel the card now, not the account and report the card stolen as it was never received to your uk address.

There are ways to learn it. For example, setting up a bougus ATM that would accept the card, ask (and record) for the PIN and display "unable to complete transaction" message and then return the card.

think_too_mut,

i have heard about this in the US happening many times, an amazing ballsy scam that works for quite a few hours and can collect lots of card numbers and pins before discovered.

[huski]

if you forget you pin number or make a mistake entering it, what every you do don't try it three times in one session at an atm. like an idiot i did, two years ago and an atm machine ate the card and wouldn't give it back.

then because the bank was not a bangkok bank branch and i was up in issan, the bank manager wouldn't give it back, saying it has to be mailed back to my branch in bangkok.

think_too_mut, what flavor of unix was this machine running?

[sting01]

>I must say I was under the *Impression* that PINs

were indeed coded within the Magnetic strip. So I am

interested to hear otherwise.

Credit card with magnetic strip ... interresting conversation ... my informations are a little bit old, but maybe still accurate, if this VERY old technology is still existing, why change the specifications???????

The strip herself is divided in 3 parts, we can call them P1, P2, P3... each have a specific goal:

inside P1 you have in a coded form (old algorythm easy to resolve) the bangking informations (# of the card, validity date, max amount ....the data vary from the bank who issue it.)

inside P2, you should have informations for third party business, it was at first designed to be used for exemple by the travel agencies, to keep trace of what you like as trabel, your most prefered Air company ..... (a little cookie) ... this track is yet useless.

inside P3, it was (it's in the technical docs I have) specified a ghost of your PIN will be inserted. The ghost of the PIN is in fact your PIN coded. Does the banks continue to do it by now? I suppose TTM is an expert, but they did it long time ago.

Question: if the PIN code is not writting on the magnetic strip, why the ATM are still have the ability to write on the ATM? What kind of information do they write? It's a cost to install a reader/writer, then if it was not interrest they will have (the ATM) only a reader and send the data on the network.

This subject is very interresting, it's also how gangs can create credit card with plastic square and WITHDRAW money in the ATM?????????? I know how to buy goods with fake CC, also how to use it on internet and do some carding .... but I wonder how it's possible with a fake CC to withdraw money from an ATM? Or it mean they found a solution to emulate also a fake PIN not checked on the network ... like a PIN write on the strip.

[think_too_mut]

think_too_mut, what flavor of unix was this machine running?

If you are relating 3 unsuccessful tries to enter a PIN to Unix SVR4 delay after each unsuccessful password attempt, that's not the case here: no Unix on ATMs. Windows NT 4.0 or OS/2 Warp.

3 chances - it's a general policy that applies to all accounts, ATM's software keeps the counter and swallows the card once the threshlod is reached.

I don't know what they are using for newly built machines. They could be coming with Linux soon but I'm not sure.

One of older IBM models (you could recognize it by the adjustable vizir for looking into a thiny screen) was still running Sinclair Z-80 CPU from 1982. Was a major hassle for Y2K remedy. I don't see them any more, they must had been beyond repair.

[think_too_mut]

>inside P3, it was (it's in the technical docs I have) specified a ghost of your PIN will be inserted. The ghost of the PIN is in fact your PIN coded. Does the banks continue to do it by now? I suppose TTM is an expert, but they did it long time ago.

I might ask tomorrow if I can get hold of former collaegues but from my memory it was checksum data.

Definitelly not a PIN.

To change your PIN, you have to go to the branch. After keying it on the enclosed keypad, with your card in it, it will be changed. The reason being - ATMs (intentionally) don't have that functionality to change the checksum data.

>Question: if the PIN code is not writting on the magnetic strip, why the ATM are still have the ability to write on the ATM? What kind of information do they write? It's a cost to install a reader/writer, then if it was not interrest they will have (the ATM) only a reader and send the data on the network.

With most banks you can use your ATM card to move your money to different accounts. To pay rent, for example.

To avoid lengthy and error-prone acccount, bank, branch...data keying for the destination account, the ATM will, after you do it first time, print and issue you with a "help" atm-size cardboard card. That card will have a magnetic strip that holds the data you entered. From then on, you insert your ATM card, press "Funds Transfer" and insert your "help" card. Enter the amount and the transaction is done.

To print on those cards, ATM has to have the magnetic stripe printer.

[taxexile]

in an earlier posting i said that when using bangkok bank telebanking services the staff get to know the pin , i may be mistaken. what happened was a member of the telebanking staff transferred the call to a computer and i was asked to key in my pin number, after which the call was transferred back to the telebanking staff. whether she actually got to see my pin or not i dont know, maybe my identity was verified by the computer before transferring me back.

its just my suspicious nature.

[thailien8]

Just relaying something I read in the paper a while back--there was a warning to never throw your ATM receipt in the garbage bin near the ATM you just used. Apparently it is possible that someone could be peering over your shoulder as you entered you PIN number, memorized it, then watched where you disposed of your receipt. The article in the paper said that there is a way to use info on the receipt in combination with the PIN number to withdraw from your account. Keep your receipts and dispose of them elsewhere.

[think_too_mut]

>maybe my identity was verified by the computer before transferring me back.

That's what had happened. Staff could not see your PIN on the screen.

The telebanking application is probably exactly the same one that runs in other banks around the world. I would trust it.

[espionage33]

Suprised to see such a in depth discussion.

It was quite painful experience for me. I have about 63,000 Baht in the account. 45,000 Baht was withdrawn at 9.30pm at a ATM teller near my house.

Surprisingly it is the 2nd nearest ATM from my house, different from the one that I always use. Another thing that I don't understand is why didn't the thief withdrew all my money. The theif withdrew 20,000 Baht twice and then one time 5000 Baht.

Chingy, I hope I was drunk that night and have kept the money somewhere. But I can still remember at that time I was watching TV at home with my ATM card in my wallet.

Roger, I have already changed my pin to a new one and will change the card as soon as I can.

Wolf 5370, I presume that reporting to the police does help as they have their means to investigate the case.

Think too mut, are you sure all the ATMs in Bkk has a camera to take a picture? Or the case you quote happened in another country. I know in Singapore, they have video camera at all ATMs. I have gone to the ATM where my money was withdrawn and check. I can't see any camera, and the branch manager of the bank insist that there isn't any camera.

Someone said that the magnetic strip of the card contains some information like the account number and perhaps pin. Does the slip show our account number? Sorry I didn't have one with me at the moment. If it does, that mean someone behind me while I use the ATM could have figured out my pin number and then get that slip from the basket where I throw the slip. Then he go somewhere make card with the information he gathered, and start withdrawing my money. Could this be possible?

I really can't think of how it happened. I have now lost confidence in Thai Bank already and will keep as little as possible in there or open a few accounts with some other bank to reduce the risk.

[think_too_mut]

> Apparently it is possible that someone could be peering over your shoulder as you entered you PIN number, memorized it, then watched where you disposed of your receipt.

The banks I knew of were not printing account number on the receipt.

May sound funny but it is not: there are ATMs that would require your fingerprint instead of your PIN. The reader has also inbuilt pulse detector...your finger should be alive and kicking...

Invented for South African market. Also, Papua New Gunea's PNGBC looked into them and 6 were installed in 1995.

[huski]

>inside P3, it was (it's in the technical docs I have) specified a ghost of your PIN will be inserted. The ghost of the PIN is in fact your PIN coded. Does the banks continue to do it by now? I suppose TTM is an expert, but they did it long time ago.

I might ask tomorrow if I can get hold of former collaegues but from my memory it was checksum data.

Definitelly not a PIN.

think_too_mut is right, there is no pin on the card

when you put in your card, you put your pin in first, yes

then you can select withdrawl, balance etc... then the authorization starts, if your pin is wrong it will tell you AFTER you have made your request, <which is usually a withdrawl> if you put the wrong pin in it will tell you AFTER your request for a withdrawl. the system then gives you another chance to enter your correct pin and then your transaction will go through if the funds are available.

Does the slip show our account number? Sorry I didn't have one with me at the moment. If it does, that mean someone behind me while I use the ATM could have figured out my pin number and then get that slip from the basket where I throw the slip. Then he go somewhere make card with the information he gathered, and start withdrawing my money. Could this be possible?

some receipts do have the entire account number printed and some have xxxxxxxxx1234, never leave the receipt, there are thai dumpster divers that could get it and binoculars are available anywhere for sale on the streets of bangkok, it doesn't have to be the guy behind you.

when entering your pin hug that machine like a beautiful bar girl and block the angles.

[Guest IT Manager]

I wouldn't lose as much confidence in the bank as in the gf personally.

Actors all. some more accomplished than others.

[huski]

I don't understand is why didn't the thief withdrew all my money. The theif withdrew 20,000 Baht twice and then one time 5000 Baht.

believe me he/she would have took it all if possible.

sounds like the thief was testing the limit on the card. maybe 20k was the limit per transaction at that machine and 45k is your daily limit. so it took 3 transactions to max it out for the day.

[pnustedt]

I have about 63,000 Baht in the account. 45,000 Baht was withdrawn at 9.30pm at a ATM teller near my house.

Anyone you know just got a new Honda Dream?