Microchips for ATM, debit cards to tackle fraud: Bank of Thailand

[metisdead]

A spam post has been removed as well as a reply.

[lomatopo]

There was an ATM skimming fraud last November at a few ATMs in/around All Seasons Place. Reports in the press said that skimmed cards were cloned and "observed/stolen" PINs were used at banks in other countries (Russia and Ukraine, I think).

I have a feeling that while EMV-equipped cards are more secure than magnetic strips, nothing is really 100% secure and thieves will eventually figure out how to clone/copy/reproduce chipped cards.

ATM skimming is a problem everywhere, regardless of the capabilities of local law enforcement.

Edited April 12, 2014 by lomatopo

[OMGImInPattaya]

Well done Thailand..... finally after 20 years, your banking system is catching up with the UK.

Next they might even start using things like PayPal..... Which is untrusted by about 95% of Thais.

Hardly...such cards have been around for only a few years, but you did make your slam Thailand post quota for the day. What's your thing with Pay-Pal...no need for it it Thailand.

[OMGImInPattaya]

My Bangkok Bank chipped card was more than a normal card. Don't think there is an annual fee. But it only works in their machines. We were down south recently, took us a few days to find an ATM that would work.

AFAIK, pretty much all the Thai banks have separate fees for both a) the issuance of new cards and b] an annual fee for as long as you keep your card.

Here's BKK Bank's current fee structure for their ATM cards:

Be1st Card (non-chipped)

Entrance Fee 100Bt

Annual Fee 200Bt

Be1st Smart Card (chipped)

Entrance Fee 100Bt

Annual Fee 200Bt until 31 December 2014 (usually 300Bt)

Note that the chipped smart card has a nominal annual fee of 300 baht vs 200 baht for the regular card.

http://www.bangkokbank.com/BangkokBank/WebServices/HelpCenter/Pages/FeeTable.aspx

But that was an initiative BKKB did on their own. None of the other Thai banks followed their course at the time.

Now that it apparently is going to become a BOT/Thailand wide requirement, I'd be very surprised if the Thai banking industry at large doesn't look for some way to recoup the costs from customers of their own insecure systems.

BTW, this changeover had already been previously announced, if memory serves. So presumably, they're just throwing this out again now because of the latest episode of ATM skimming in BKK and the publicity associated with that.

There is nothing insecure about the system except the people who use it. A cursory look at any ATM machine can determine if its been tampered with. Also, ATM's are offered for customers' convenience, you don't have to have a card and are free to do all your banking transactions at the teller window. Edited April 12, 2014 by OMGImInPattaya

[OMGImInPattaya]

I have been with Bangkok Bank for 7 years now and as soon as I heard from a friend of mine of mine that his magnetic strip card had been skimmed at Bangkok bank on Second road in Pattaya opposite he VC Lounge I immediately went to the main Branch, my Branch, near the Grand Sole hotel and changed my card to a microchip smart BE FIRST Card and I am so glad I did that. I think there was a small fee but it was well worth it and I have never had any problems in the 18 months I have had the new smart card. I recommend anyone with the simple magnetic strip cards to get them changed as quickly as possible.

My friend lost 200,000 baht in 2 days with his old card-type and to this day I believe he has not received any compensation

back from the bank. Just do it !

Obviously your friend was too dumb to configure his security settings correctly! All one has to do is link all ATM transactions to the bank's SMS service. Then, literally as soon as any transaction take place using the card (POS or cash withdrawal or payment) one receives a phone message. I literally get them seconds after the card us swiped as I'm still in the checkout line. One unauthorized use and a quick call to the bank any further use blocked. One can also set lower amounts for cash withdrawls, POS transactions, and daily limits than the rather high Thai bank defaults. Easy peasy.

[pitrevie]

I have a new chipped card from Bangkok Bank. The extra security is nice but it really sucks that the only place they work is at Bangkok Bank ATM's. I used to be able to withdraw money from my Thai account all over the world, now I have to plan ahead to make sure I can find one of their ATM's when I'm in Thailand if I need some cash.

The will issue you with a second card if you request it on the same account which does not have the chip and can be used in other machines. However I think now the charge is about 200 baht annually for each ATM card.

[craigt3365]

My Bangkok Bank chipped card was more than a normal card. Don't think there is an annual fee. But it only works in their machines. We were down south recently, took us a few days to find an ATM that would work.

AFAIK, pretty much all the Thai banks have separate fees for both a) the issuance of new cards and b] an annual fee for as long as you keep your card.

Here's BKK Bank's current fee structure for their ATM cards:

Be1st Card (non-chipped)

Entrance Fee 100Bt

Annual Fee 200Bt

Be1st Smart Card (chipped)

Entrance Fee 100Bt

Annual Fee 200Bt until 31 December 2014 (usually 300Bt)

Note that the chipped smart card has a nominal annual fee of 300 baht vs 200 baht for the regular card.

http://www.bangkokbank.com/BangkokBank/WebServices/HelpCenter/Pages/FeeTable.aspx

But that was an initiative BKKB did on their own. None of the other Thai banks followed their course at the time.

Now that it apparently is going to become a BOT/Thailand wide requirement, I'd be very surprised if the Thai banking industry at large doesn't look for some way to recoup the costs from customers of their own insecure systems.

BTW, this changeover had already been previously announced, if memory serves. So presumably, they're just throwing this out again now because of the latest episode of ATM skimming in BKK and the publicity associated with that.

There is nothing insecure about the system except the people who use it. A cursory look at any ATM machine can determine if its been tampered with. Also, ATM's are offered for customers' convenience, you don't have to have a card and are free to do all your banking transactions at the teller window.

I saw an article on an ATM that was tampered with. You would never know it by looking at it. It even stumped the "experts". I'll try to find the link and the pics. They are getting very creative nowadays.

I only use ATMs inside a building...prefer one inside a bank.

[OMGImInPattaya]

My Bangkok Bank chipped card was more than a normal card. Don't think there is an annual fee. But it only works in their machines. We were down south recently, took us a few days to find an ATM that would work.

AFAIK, pretty much all the Thai banks have separate fees for both a) the issuance of new cards and b] an annual fee for as long as you keep your card.

Here's BKK Bank's current fee structure for their ATM cards:

Be1st Card (non-chipped)

Entrance Fee 100Bt

Annual Fee 200Bt

Be1st Smart Card (chipped)

Entrance Fee 100Bt

Annual Fee 200Bt until 31 December 2014 (usually 300Bt)

Note that the chipped smart card has a nominal annual fee of 300 baht vs 200 baht for the regular card.

http://www.bangkokbank.com/BangkokBank/WebServices/HelpCenter/Pages/FeeTable.aspx

But that was an initiative BKKB did on their own. None of the other Thai banks followed their course at the time.

Now that it apparently is going to become a BOT/Thailand wide requirement, I'd be very surprised if the Thai banking industry at large doesn't look for some way to recoup the costs from customers of their own insecure systems.

BTW, this changeover had already been previously announced, if memory serves. So presumably, they're just throwing this out again now because of the latest episode of ATM skimming in BKK and the publicity associated with that.

There is nothing insecure about the system except the people who use it. A cursory look at any ATM machine can determine if its been tampered with. Also, ATM's are offered for customers' convenience, you don't have to have a card and are free to do all your banking transactions at the teller window.

I saw an article on an ATM that was tampered with. You would never know it by looking at it. It even stumped the "experts". I'll try to find the link and the pics. They are getting very creative nowadays.

I only use ATMs inside a building...prefer one inside a bank.

Of course, your suggestion is the other main way to avoid tampered machines...use ones inside or directly outside branches and sub-branches. Never use free-standing machines found littered about the roads and sois. Ones found outside 7-11s and Family's are probably as they're open 24/7 so a little more difficult for crims to attached their skimming equipment (unless the staff are in on it).

However, as I say, no need to be paranoid about Thai ATMs. Just configure your account security settings as mentioned and one has little to worry about and amount at risk would be reduced. One has to balance the small risk with the great convience of 24/7access to ones money and if one doesn't want to take any risk then there is always the no ATM card route.

[TallGuyJohninBKK]

OMG, when I said "insecure," I meant it in terms of the ability of hackers to relatively easily compromise the physical ATM machines with their various skimming techniques. If the ATMs were "secure," there wouldn't be scores of skimmers out there able to successfully tamper with them. And contrary to what you said above, some of the skimming techniques are nearly impossible to detect.

The magnetic strip cards aren't secure. The ATMs themselves aren't secure. And most importantly, Thailand, unlike the U.S., has no consumer protection law that guarantees that people who lose their funds through ATM or online fraud will get their funds restored.

In the U.S., I never worried about it too much, because I knew even if my card was compromised, I wouldn't be out a dime, most of the time. But here, if I had any money associated with a commonly used Thai bank ATM card account, I'd worry a lot. In my case, though, I don't. So I sleep well at night.

[craigt3365]

Great recommendations, OMG. I'll try to implement those immediately. Thanks!!

[lomatopo]

All one has to do is link all ATM transactions to the bank's SMS service. Then, literally as soon as any transaction take place using the card (POS or cash withdrawal or payment) one receives a phone message

The SMS service/notification is definitely a plus, and the small fee (10 baht/month ?) is definitely worth it, but some have reported being the victim of fraud while traveling outside the country where SMS notification was not available. And I'm not certain how timely the flow of information is from a Russian bank - where a cloned card/PIN might be used, to the Thai Bank, for issuance of an SMS alert?

Also note that many banks have a 25,000 baht minimum daily limit on the low-end, so best (of a worst) case you're going to be out 25,000, assuming you get on to the bank ASAP, which I agree is better than 200,000.

Some here have recommended the two account plan, one of which has the bulk of your funds and no ATM/Visa debit card associated with it, and the other, with an associated ATM card, has a limited amount of funds. I've been meaning to do this but just have never gotten around to it. I have a BBL Be1st chipped card, and an SCB account with a standard ATM card, but I keep funds in the SCB account of less than 25,000 baht - I just withdraw cash from BBL and deposit it into SCB to avoid any transfer fees.

[TallGuyJohninBKK]

The various approaches and safeguards for this have been much discussed here in various threads because, of course, skimming and card fraud occurs a lot here.

Some of the various safeguards re using Thai bank ATM/debit cards:

--the two accounts approach, one with a debit card holding few funds, and the other with no card and holding most of the funds, and then transferring as needed via online banking.

--setting up the debit card account with email or SMS alerts if your bank offers them.

--setting the POS limit on your debit card to zero, so it can't be used for swipe and sign transactions if lost or stolen.

--reducing the often quite high daily ATM cash withdrawal on your debit card.

--opting for a chipped card with BKK Bank now, or other Thai banks when they come available.

[OMGImInPattaya]

OMG, when I said "insecure," I meant it in terms of the ability of hackers to relatively easily compromise the physical ATM machines with their various skimming techniques. If the ATMs were "secure," there wouldn't be scores of skimmers out there able to successfully tamper with them. And contrary to what you said above, some of the skimming techniques are nearly impossible to detect.

The magnetic strip cards aren't secure. The ATMs themselves aren't secure. And most importantly, Thailand, unlike the U.S., has no consumer protection law that guarantees that people who lose their funds through ATM or online fraud will get their funds restored.

In the U.S., I never worried about it too much, because I knew even if my card was compromised, I wouldn't be out a dime, most of the time. But here, if I had any money associated with a commonly used Thai bank ATM card account, I'd worry a lot. In my case, though, I don't. So I sleep well at night.

I guess we just have different definitions of "secure" and "fraud." As I said, every activity of life has risks and it's the balance if risk rewards, or in the case of ATM's, convenience, people have to make for themselves. Out of the total number and amounts of money transactions done daily through Thai ATM's vs. the amount of fraudulent transactions must be very very small. In fact, I would guess to say it's de minimus. Of course, if it happens to you it's certainly a downer. Yes, the skimming devices can be quite convincing but are generally placed on the machines in a not very secure manner. At every machine I use, I check the keypad by closely examining it to see that it is one with the machine and I will use my fingernails to feel and grip the edges to see if there is any give or it can be lifted off. I also give the card slot a couple whacks to see if it too is integral to the machine or not. These steps just take a couple seconds and combined with the advice to not use isolated feee-standing machines reduces the chance of using a tampered machine close to zero IMHO.

As to fraud protection, if account holders allow their account credentials to be compromised, even by using a tampered machine, I don't consider it fraud but carelessness. I don't feel the bank has any legal or moral obligation to make the customer whole. If they have a public relations reason that's up to them. As I've also said, there are ways to further configure one's account security settings to further reduce the chance or limit the amount of any loss due to ATM skimming and there is also the option to decline the convenience of using an ATM card altogher.

Edited April 12, 2014 by OMGImInPattaya

[OMGImInPattaya]

All one has to do is link all ATM transactions to the bank's SMS service. Then, literally as soon as any transaction take place using the card (POS or cash withdrawal or payment) one receives a phone message

The SMS service/notification is definitely a plus, and the small fee (10 baht/month ?) is definitely worth it, but some have reported being the victim of fraud while traveling outside the country where SMS notification was not available. And I'm not certain how timely the flow of information is from a Russian bank - where a cloned card/PIN might be used, to the Thai Bank, for issuance of an SMS alert?

Also note that many banks have a 25,000 baht minimum daily limit on the low-end, so best (of a worst) case you're going to be out 25,000, assuming you get on to the bank ASAP, which I agree is better than 200,000.

Some here have recommended the two account plan, one of which has the bulk of your funds and no ATM/Visa debit card associated with it, and the other, with an associated ATM card, has a limited amount of funds. I've been meaning to do this but just have never gotten around to it. I have a BBL Be1st chipped card, and an SCB account with a standard ATM card, but I keep funds in the SCB account of less than 25,000 baht - I just withdraw cash from BBL and deposit it into SCB to avoid any transfer fees.

As for traveling, sure it's possible but what are the odds? I don't know if its possible, but if one was really concerned about this, one might contact the bank and place a "hold" on any ATM transactions during the travel period. If this is not possible, one could just cancel the card and then pay a few hundred baht for a new one on their return.

If the Ruskie (or wherever bank) is part of the major ATM network systems, the debit and notification is immediate as that's when the cash is taken from the account. And the resulting SMS from the Thai bank would be immediate. Again, if this was a concern, one can get non-international network ATM cards that only work in domestic Thai ATM's.

[Tomtomtom69]

When will THAI retailers stop accepting signatures and only using PINs for card purchases? In Australia, by next week (August 1st) signatures will no longer be acceptable for debit or credit card transactions. Apart from the introduction of contact less VISA Paywave machines at retailers such as Tesco Lotus and Big C, I have not seen any evidence that retailers in Thailand will be moving away from signatures any time soon. They should though, to prevent fraud. A signature is easy to forge, a PIN is much harder to guess, with only a 1 in 10000 chance of guessing correctly for 4-digit PINs.

It wasn't that long ago that when you went shopping in Thailand, your ENTIRE credit card details including the full 16-digit card numbers and expiry dates were printed on all credit card slips. A fraudster could have easily used their mobile phones to type in these card details while waiting for their goods to be scanned at shopping mall or supermarket checkouts. Fortunately, retailers were finally smart enough to start blacking or crossing out parts of these details, which means scamming is essentially no longer possible. However, I'm surprised that as recently as around 2007-2008 (as far as I can remember) seeing the full credit card or debit card details was normal.

Seems like Thailand is always behind.

On another note:

How many more decades will it take the Thai motorway/expressway authorities to finally stop accepting cash at all toll booths and implement Singaporean or Australian style automatic gentries, where you can just drive through the toll collection points and the toll collection unit (E-Tag) inside your car beeps once, deducting the toll electronically? Instead of the massive traffic jams and pollution that the decades old practice of manual toll collection creates? Not to mention how it affects the health of those poor workers who work there, even with their masks on. And sorry, the current E-Pass is a sore joke sometimes it's even slower than paying by cash - it doesn't function like the E-Tags used in more advanced countries.

[Basil B]

There has in the past been many calls for Thailand to introduce "Chip & Pin", the previous government just deafed it it out with feeble excuses, almost as if they were on the side of the crooks.

[geodesic]

To my knowledge, all chip cards still have magstripe as well. Thus, there is a fallback if you travel to a country that has not adopted EMV yet.

That may be what you are told on paper, but it is a crock. I recently had the experience of trying to use one of Bangkok Bank's new ATM cards in the rural USA. The nearest EMV atm was 8 hours away in Denver according to the local bank.

The magnetic stripe was useless. Despite trying over 12 different ATMs all connected to various combinations of networks (Visa, Mastercard, PLUS, etc), none of them would accept that card.

There is no practical fallback. EMV cards can only be relied upon to work in EMV enabled ATMs.

Finally broke down and had someone send me money via Western Union. EMV cards are the devil. The government should pass a law requiring all cards to work in fallback mode before they can be dumped on unsuspecting consumers.