ATM Card Scanner Theft: How's it work and what to look for?

[kbelyeu]

My atm card has a microchip in it so even if it's skimmed the microchip cannot be copied. Banks from other countries have it you guys must be using atm cards from thai banks to have such problems.

I used to think this until I found out the hard way. My UK HSBC account is a chipped card and has been readily skimmed on several occasions over the last 5 or so years both in Brasil and in Thailand. The card is designed to work with the chip or without which makes it backwards compatible with older visa card readers that don't accept chip and pin. In layman's terms they skim the card, video you entering the PIN and program to a new card.

Regards,

Kurt

[Water Buffalo]

Would changing your password solve this problem if your card had been skimmed?

[TallGuyJohninBKK]

About some of the points raised above:

--BKK Bank does offer a chipped debit card.... But the drawbacks of it are, at present, it doesn't work with ANY other Thai banks' ATMs, nor does it work in many other places outside Thailand. For those reasons, many customers don't use it. I don't know whether BKKB's chipped card has the same flaws or not as mentioned by member Kbelyeu with his UK HSBC card.

--As for counter withdrawals (going to the bank teller instead of to an ATM), some banks discourage that by telling customers to instead go and use their ATMs when they arrive at the counter. And another drawback of that approach, apart from the language difficulties sometimes involved, is having to carry around your original passport whenever you want to make such a counter withdrawal... and the risk of losing or having your passport stolen.

--The Thai banks seem to be very uneven with their automatic notification practices... Some offer that, some don't. And among those that do, some want an extra monthly debit/charge from your account to pay for the notification service.

For example, with a Standard Chartered account I have, I am required, it seems, to validate via SMS-delivered code any time I want to use SC online banking to pay a bill. But, when I use my SC ATM card to withdraw funds from their ATMs, I get no SMS or email notification at all.

Also, BKK Bank has an SMS notification service, for which they want to charge 120 baht per year (10 baht per month). But from reading their website, while it does appear to cover things such as transfers in or out of accounts, payments and check deposits, I can't tell whether or not the notification would arrive in the event of ATM withdrawals.

http://www.bangkokbank.com/BangkokBank/PersonalBanking/DailyBanking/SMSAlerts/Pages/alert.aspx

So, if anyone has a better feel for what if any Thai banks offer FREE SMS or email notifications for ATM withdrawals or all account transactions, please do post the info here. I'm sure everyone would appreciate the info.

For my part... I like using AEON ATMs that are located in or as part of their branches. Not only is there no 150/180 baht per withdrawal fee on foreign card withdrawals, but there's also less likelihood that the criminals are going to target an ATM that inside or part of a staffed bank-type branch. The standalone ATMs, on the other hand, aren't so closely monitored and probably are more vulnerable to tampering.

Edited November 15, 2013 by TallGuyJohninBKK

[p_brownstone]

My atm card has a microchip in it so even if it's skimmed the microchip cannot be copied. Banks from other countries have it you guys must be using atm cards from thai banks to have such problems.

I used to think this until I found out the hard way. My UK HSBC account is a chipped card and has been readily skimmed on several occasions over the last 5 or so years both in Brasil and in Thailand. The card is designed to work with the chip or without which makes it backwards compatible with older visa card readers that don't accept chip and pin. In layman's terms they skim the card, video you entering the PIN and program to a new card.

Regards,

Kurt

Not being contentious OK - just for information.

Where do you think your PIN Code is stored?

In the VAST majority of cases it's stored in that little Magnetic Strip on your Card.

Even if you go to an ATM and change your PIN Code, do you think it's recorded by the NSA (or Bank of America, Barclays - whoever) and when you next try to access your Account the ATM in Thailand requests confirmation from the NSA?

Or even your issuing Banks Central HQ?

No - the information is also changed and stored in that small Magnetic Strip on your Card.

If someone uses an RFID Skimmer, plus easily available Software and Hardware, they can copy ALL the information on your Card - your Name, Address, Account Info., AND your PIN Code and easily Clone another Card - without even touching you - absolutely no need for clumsy, low tech Video Cameras etc. installed in an ATM anywhere.

Patrick

[TallGuyJohninBKK]

I see Siam Commercial has posted this info on their English website...

Speaking personally, I certainly have "complete condence" in them...

ATM Rumors

http://www.scb.co.th/en/news/2013-11-11/nws-skimming

[TallGuyJohninBKK]

About the SCB alerts, their pricing seems to be a bit confusing. At one point on their webpage, they talk about "free" SMS alerts.

But then I did a websearch, and came up with this page that talks about their SMS alert service for savings accounts, as of Aug 2013, costing 199 baht per year, or 20 baht per month.

http://www.scb.co.th/en/personal-banking/electronic-banking/sms-alert

Meanwhile, here's the link for Standard Chartered's SMS Alert info page...and their service appears to be free.

http://www.standardchartered.co.th/personal-banking/electronic-banking/smsbanking/en/

Edited November 15, 2013 by TallGuyJohninBKK

[louse1953]

My atm card has a microchip in it so even if it's skimmed the microchip cannot be copied. Banks from other countries have it you guys must be using atm cards from thai banks to have such problems.

Thais banks have chips.

[HerbalEd]

Bangkok Bank do have the Be1st ATM card with the EMV chip technology; believe the annual fee is reasonable? Maybe 100 baht to join, and 300 baht/year? Its use requires a specific ATM, and not all ATMs are capable of utilizing this technology.

Some change their PIN often, enroll in SMS alerts (again, this may incur a fee), and have two accounts, one associated with an ATM card into which very limited funds are transferred - via on-line banking, from a second account, which does not have ATM card access.

All of this is exactly what I do. So far so good.

[Swiss1960]

Physical devices, Readers, Cameras etc. attached to the actual ATM are basically Stone-age technology.

Google "RFID Skimming" and be very afraid!

Then go to eBay or Amazon and you will find equipment to Scan Credit Cards even when they are in the Targets pocket and yet other equipment and Software to Clone the captured Card - all easily available on-line.

You can buy Wallets etc. designed to help protect against these Scanners but most people think the only need to cover the Keypad on the ATM!

Patrick

... and most of what you will find and read is basically all bullshit and does NOT work for any EMV card where the contactless (RFID) function is on the Chip

[Swiss1960]

Would changing your password solve this problem if your card had been skimmed?

You don't have a password, you have a PIN. It will only stop fraud on devices where PIN entry is needed... which is almost nowhere in Thailand, except for ATM's

[Swiss1960]

My atm card has a microchip in it so even if it's skimmed the microchip cannot be copied. Banks from other countries have it you guys must be using atm cards from thai banks to have such problems.

I used to think this until I found out the hard way. My UK HSBC account is a chipped card and has been readily skimmed on several occasions over the last 5 or so years both in Brasil and in Thailand. The card is designed to work with the chip or without which makes it backwards compatible with older visa card readers that don't accept chip and pin. In layman's terms they skim the card, video you entering the PIN and program to a new card.

Regards,

Kurt

Not being contentious OK - just for information.

Where do you think your PIN Code is stored?

In the VAST majority of cases it's stored in that little Magnetic Strip on your Card.

Even if you go to an ATM and change your PIN Code, do you think it's recorded by the NSA (or Bank of America, Barclays - whoever) and when you next try to access your Account the ATM in Thailand requests confirmation from the NSA?

Or even your issuing Banks Central HQ?

No - the information is also changed and stored in that small Magnetic Strip on your Card.

If someone uses an RFID Skimmer, plus easily available Software and Hardware, they can copy ALL the information on your Card - your Name, Address, Account Info., AND your PIN Code and easily Clone another Card - without even touching you - absolutely no need for clumsy, low tech Video Cameras etc. installed in an ATM anywhere.

Patrick

Now THIS is completey bullshit...

- NO PIN is stored on the magstripe, it is a PVV (PIN Verification Value) but NO PIN, neither on the magstripe nor in the Chip!!!!!

- MOST cards have a high cohersity magstripe which does NOT allow the PVV of a new PIN to be written back, so once you change your PIN, the value on the card is NOT needed anymore

- there is NO Address, NO Account Information, NO PIN code on the magstripe OR the Chip!!!! there are NO such fields in the layout of the 3 magstripe lines nor on the CHIP specification!!!

AND I KNOW ABOUT THAT! I am working in the credit card sector for more than 15 years now!

[Bkungbank]

Apply SMS from bank, every transcation will be inform card owner. Safety way to protect your money and set credit limit witdrawal.

[noikrit]

My atm card has a microchip in it so even if it's skimmed the microchip cannot be copied. Banks from other countries have it you guys must be using atm cards from thai banks to have such problems.

I used to think this until I found out the hard way. My UK HSBC account is a chipped card and has been readily skimmed on several occasions over the last 5 or so years both in Brasil and in Thailand. The card is designed to work with the chip or without which makes it backwards compatible with older visa card readers that don't accept chip and pin. In layman's terms they skim the card, video you entering the PIN and program to a new card.

Regards,

Kurt

Not being contentious OK - just for information.

Where do you think your PIN Code is stored?

In the VAST majority of cases it's stored in that little Magnetic Strip on your Card.

Even if you go to an ATM and change your PIN Code, do you think it's recorded by the NSA (or Bank of America, Barclays - whoever) and when you next try to access your Account the ATM in Thailand requests confirmation from the NSA?

Or even your issuing Banks Central HQ?

No - the information is also changed and stored in that small Magnetic Strip on your Card.

If someone uses an RFID Skimmer, plus easily available Software and Hardware, they can copy ALL the information on your Card - your Name, Address, Account Info., AND your PIN Code and easily Clone another Card - without even touching you - absolutely no need for clumsy, low tech Video Cameras etc. installed in an ATM anywhere.

Patrick

Now THIS is completey bullshit...

- NO PIN is stored on the magstripe, it is a PVV (PIN Verification Value) but NO PIN, neither on the magstripe nor in the Chip!!!!!

- MOST cards have a high cohersity magstripe which does NOT allow the PVV of a new PIN to be written back, so once you change your PIN, the value on the card is NOT needed anymore

- there is NO Address, NO Account Information, NO PIN code on the magstripe OR the Chip!!!! there are NO such fields in the layout of the 3 magstripe lines nor on the CHIP specification!!!

AND I KNOW ABOUT THAT! I am working in the credit card sector for more than 15 years now!

You may be the man then .... So what are the best ways to protect oneself against ATM scam ... Kind Regards

[Swiss1960]

You may be the man then .... So what are the best ways to protect oneself against ATM scam ... Kind Regards

There is no 100% security. Today's scanning devices and cameras are almost undetectable, even for professional eyes.

Basic elements:

So the first thing to do is protect your PIN when entering.

Go to ATM's inside banks, inside shopping malls. They are less likely to have scamming devices attached.

Get yourself a card with SMS alert for every transaction. This is the best way to immediately stop fraud when it happens.

Send people away that are too close to you when you use an ATM. From personal experience, out of 5 people, 3 enable me to see their PIN entry...

If you are unsure about the ATM or the people that watched you, but had to use it anyway => immediately change your PIN at another ATM.

Credit Cards

if possible, use your foreign credit card. not only do most of them have EMV chips, but more important they have much better fraud protection systems and fraud protection consumer laws.

Thai ATM Cards

Most of us have cards attached to our Thai Bank account. Never have more money on your account than you need for the monthly transactions. Fill the account twice a month through e-banking with i.e. 50K Baht, so that will be the max that could be stolen.

Contactless Cards

If you have European, chip based contactless cards, dont' worry about fraud. American contactless cards (mag stripe based) are less secure, but still this fraud scheme is not important on a fraud scale.

Sounds basic? It IS basic... and still, I have had my own cards skimmed and had fraud on them on various occasions, as I said, there is no 100% security. And to make this clear: The fraud did NOT only happen in Thailand, it also happened to me in Switzerland, in France, in the US, in the Ukraine and yes, also in Thailand.