New bank cards to help protect Thai customers from 'skimming'

[arjunadawn]

Such things are always to "help you" or "for the children." Most folks will not see the objection to such 'advances'; I do, its a different POV.

This is part of the cashless society/control the flow of money program. Its hardly divorced from EU removing the 500Euro note (and the US planning to stop printing $100 bills). Its all the tightening over the money supply and distribution. Its the same package of products offered to "help the customer" and "stop crime" but curiously result in the total control over the flow of money, its pattern of distribution, and shortly to end private transactions. Its not just Thailand.

If anyone gets a hankering to understand this more there is a great deal of information on line, and the tech is pretty simple. After that, then look at what folks are saying about the context. Regardless of the reason why its asserted such changes are needed they all have the combined effect to change society and the flow and control of money in many unpleasant ways.

[hobobo]

New bank cards to help protect Thai customers from 'skimming'

The National Computer Crime Protection office said that the problem of skimming had caused losses of 128 million baht in the country in 2013 alone. Banks have spent around 1.5 billion baht on the problem.

Source: Tnamcot

-- 2016-05-05

Interesting. I expected a lot more. I thought Thailand is a paradise for skimmers worldwide. Come here on holiday for 3 weeks and come back home with big cash....

And now they are watching you...........

[Pib]

,,,,,,,,,,,,,skimming had caused losses of 128 million baht in the country in 2013 alone.

I find it difficult to believe that only 128m ThB was stolen, surely much more than this?

I expect that is the amount reported to the Bank of Thailand from Thai banks of what they had validated as a fraudulent skimming transaction "and reimbursed the card owner."

I also expect the amount claimed as fraudulent skimming by Thai card owners but "denied for reimbursement" by Thai banks was much higher due to weaker consumer protection laws as compared to most western countries.

[Pib]

Here's a 5 May 16 The Nation article on the Thai banks transition to chipped debit cards and upgrading their ATMs. Pretty good article considering it's from The Nation.

Now where they say 86% percent of Thai bank ATMs have been upgraded to accept chipped cards, I'm not sure I'm buying that especially in terms of working properly with "all chipped cards." I say that because Bangkok Bank Be1st chipped debit cards supposedly can only be used in Bangkok Bank ATMs "and EMV-capable ATMs" (EMV is the international standard for chip cards/devices) since Bangkok Bank ATMs are EMV-complaint according to Bangkok Bank.

With that being said for you folks with Bangkok Bank Be1st Smart/chipped cards (not talking the older Be1st magnetic strip only cards) can you now use your Be1st chipped card in most (like 86%) of Thai bank ATMs, repeat, other Thai bank ATMs such as Kaiskorn, Krungsri, SCB, etc.?

http://www.nationmultimedia.com/business/Debit-ATM-cards-to-be-chip-based-30285334.html

Debit, ATM cards to be chip-based

SUCHEERA PINIJPARAKARN
THE NATION May 5, 2016 1:00 am

STARTING from May 16, all newly issued ATM and debit cards in Thailand will be chip-based as opposed to magnetic-stripe cards, while the existing 60 million magnetic-stripe cards will be migrated to chip cards by the end of 2019.

If cardholders fail to change to the chip cards by that deadline, they will not be able to use their cards for any transactions at automated teller machines or for electronic data capture, the Bank of Thailand's deputy governor for financial-institutions stability, Tongurai Limpiti, said yesterday.

More than 40 million of the total 60 million magnetic-stripe cards are debit cards, with the remainder serving solely as ATM cards.

Several bankers believe the role of ATM cards will decline after the move to chip-based cards is implemented, as consumers will prefer debit cards because they can be used both at ATM machines and with merchants.

A debit card is similar to a credit card, but cardholders must have a savings account with a bank to qualify for one.

However, the use of debit cards in Thailand is not as widespread as for credit cards, because many people are not confident they are fully secure and some merchants still do not accept debit cards.

That said, the national e-payment system and the arrival of chip-based cards will ease the concerns of both users and traders, Tongurai said.

Thailand will be the third country in Asean to implement chip-based debit and ATM cards, after Singapore and Malaysia, said Predee Daochai, chairman of the Thai Bankers' Association (TBA) and president of Kasikornbank.

Malaysia started using chip-based cards in 2004, and Singapore implemented such a system in 2011.

TBA members have allocated more than Bt1 billion to adjust their back-office systems, card issuance and card-accepting systems to serve the upcoming chip-based era, he said.

The service fees for chip-based debit and ATM cards will be unchanged from those for magnetic-stripe cards, he added. At present, banks charge an entrance/card replacement fee of Bt100 for issuing a basic debit card, plus an annual fee of Bt200 per customer.

Predee said about 86 per cent of the 60,000 ATMs nationwide had already been upgraded to accept chip-based debit and ATM cards, with each bank gradually improving their machines to accept the cards by the end of this year.

[american12bthai]

nope. and a news outlet that constantly produces incorrect headlines should be abandoned. sure believe this headline. meanwhile u can buy the parts to make a scaner/reader in fortune...

[bentfarang]

Big C now using Wireless technology terminals! Since they never looked at the card signature, I wonder!!

The chip cards are meant to require a pin number, not signatute. So, in my home country retailers would always 'dip' the card with you present. However, a signature may be required when 'swiping' the card... which sometimes is necessary when the POS machine can't read the chip for some reason. Then a third case... toll gates. Cards are swiped and no signature required. It all gets a bit confusing for me... but I do know that Thais usually get confused about needing my pin number.

[paulbj2]

Crooks can read a chipped card while it's in your pocket. The only way to stop this is wrap the card in foil.

Aren't you supposed to wear the foil on your head?

Yes but foil hats are so dreadfully sweaty in this weather!

[paulbj2]

Such things are always to "help you" or "for the children." Most folks will not see the objection to such 'advances'; I do, its a different POV.

This is part of the cashless society/control the flow of money program. Its hardly divorced from EU removing the 500Euro note (and the US planning to stop printing $100 bills). Its all the tightening over the money supply and distribution. Its the same package of products offered to "help the customer" and "stop crime" but curiously result in the total control over the flow of money, its pattern of distribution, and shortly to end private transactions. Its not just Thailand.

If anyone gets a hankering to understand this more there is a great deal of information on line, and the tech is pretty simple. After that, then look at what folks are saying about the context. Regardless of the reason why its asserted such changes are needed they all have the combined effect to change society and the flow and control of money in many unpleasant ways.

Other than buying a car or other really high ticket items for cash which is discouraged these days, I can't really see a use for €500 notes. They were only introduced as a sop to countries that already had very high value notes in circulation. They are in effect of very little use. The only people who handle them enough to know a good one from a dud are the banks; virtually no shops will accept them so what is the point in having them? Same goes for $1000 bills. Most people have never even seen one!

[Thunderbirds20]

no doubt the customer will have to pay to get a new card, ...even though we paid for the old one already, ..... Banks!!! No such thing as free service

[koo]

Crooks can read a chipped card while it's in your pocket. The only way to stop this is wrap the card in foil.

First of all, chipped cards need a physical contact card reader - NFC cards are another deal altogether.

When you pay with a magstripe card, the card info is read and then the payment is sent from the terminal. Because of this one way communication, it is pretty easy to skim the info from the card and reuse it by printing a new card with the same details.

With chip cards, the chip has a small microprocessor in it and a secret key code. The sales terminal (or ATM) presents the card's chip with a mathematical challenge that requires using card number + PIN and the card's secret key. It might also include more items such as amount, date, time, POS/ATM code etc. The chip calculates a checksum based on this info, which is sent to the card issuer with the payment info. Only if the sent checksum matches the card issuer's one, will the payment/withdrawal go through. The security here is that in no circumstance can you get the secret code from the card - the interface is built so that it can only provide checksums. Also the calculation algoritm is tamper proof, it can not be reverse engineered. This is why chip cards can not be copied - you can copy the card number, but without the PIN the chip will not calculate the checksum, and without the checksum your withdrawal/purchase will not be validated.

NFC cards can be read from up to 5 cm (2in) distance. The fear here is that someone would go around in crowded places and read your NFC card with a portable reader through handbags and wallets. While this generally would be possible for static NFC/RFID tags (that are used in automatic warehouses to track goods), the NFC chips on payment cards are another issue altogether. Because the card's NFC chips include the above mentioned chip technology, ramming through a crowd of people trying to read the cards just doesn't work. You would have to have a POS terminal with you, and read each card individually and present a sales transaction to it. Of course you could just automate it and let it make purchases to the max amount (25 USD/EUR) each time a card is within reading range. But because you have to use a POS terminal connected to the card issuer, it means virtually the same as trying to rob a bank and depositing the money on your account. Pretty useless to a crook - very low return and 100% chance of getting caught.

In Thailand, Bangkok Bank was the first bank to roll out chip cards. The cards have a magstripe to serve merchants that have older terminals, but cash withdrawals are limited to ATMs with Chip+PIN technology (technical limitation set by to Bangkok Bank ATM network: If Be1st card onlu chip+pin accepted). Still about a year ago it was easy to say that you could only use your card in Bangkok Bank ATM's, since they were the only ones using chip+pin. But now that other banks have adopted the technology, one should be able to use the Be1st cards in other bank's ATMs as well.

Edited May 6, 2016 by koo

[paulbj2]

Thanks for the enlightenment! I was 99.99% certain that chip and pin cards presented no risk of remote reading but it's good to hear that confirmed. Just before leaving for Thailand, I bought a "Lifeventure" brand "bum-bag" that made much of its ability to stop credit/debit cards with NFC capabilities from being read remotely and thus pilfered by crooks. I didn't buy it for that reason, I bought it because it was the only one I could find and indeed have ever found that has belt loops rather than its own waistband. It sounds like their sales pitch is a bit exaggerated.

[Pib]

All chipped cards do not need to make contact like the type of chips used in Visa Wave card (contactless chip) which you just wave in front of the reader. Contactless chip cards should not be confused with the older/simpler RFID tags/devices. See below partial quote and weblink for more info...the weblink takes you to a 3 page PDF document that gives a good, layman's overview of RFID Tags and Contactless Chip Technology.

http://d3nrwezfchbhhm.cloudfront.net/pdf/rfidvscontactless_final_121704.pdf

[sikishrory]

Banks said that teething problems experienced by some customers with the new cards in not being able to use the cards at ATMs other than their own bank have now been addressed.

Have any Bangkok Bank Be1st Smart Card (chipped) debit card users been able to use their card in another Thai ATM successfully other than Bangkok Bank ATMs? Above says it has now been addressed....but I expect "addressed" just means we'll eventually get there.

I had my chipped bkk bank card for quite awhile now and it has been a real pain in the butt not being able to use it at so many atms. I did recently use it overseas though. Will soon see if these problems have really been addressed or not. I doubt it

[Stradavarius37]

Here's a story that will this article laughable.... I hold a very prestigious card from one of the big banks

that every online transaction you do will have to be verified by an OTC email to me ( one time code )

where I enter it to conclude the transaction,

few days ago I get an sms thanking me for using my card to purchase something for 5,000 baht

which I didn't, upon inquiring with the bank I'm told that someone from China has used my card,

I did remember getting an email from the few days earlier in the morning with an OTC message

in it which I disregard because I didn't buy anything, sure enough, few days later, I get this thank

you message, so now they had to replace my card at a great inconvenience to me....

Poor guy... 15 minutes to get a new card. You must be overcome...

[JimGant]

I do not see how its possible for the magnetic strip to be protected from being skimmed just because there is a chip on the card.

Only reason to keep the magnetic strip is compatability with old ATM machines ?

Backwards compatible so skimable as before.

True. But usable only in the older (non chip reading) ATMs and POS machines. A skimmed chip card, however, won't work in a chip reading machine -- because the magnetic stripe has additional code that says, "this card has a chip." As such, if you swipe such a card in a chip reading machine, it will tell you, "sorry buddy, you have to dip this card." Now, can the crooks remove this additional code, resulting in a magnetic stripe that resembles a non-chip card stripe? Probably. Degree of difficulty? Dunno.

[JimGant]

but I do know that Thais usually get confused about needing my pin number.

So your card has strictly a "chip and pin" mode, with no fall back to a "chip and signature" mode? I guess the issuer could do that, if he wanted max security. But Thai POS machines are programmed to fall back to the chip and signature mode when presented with a chip and pin card. But if your card is programmed to not allow that, could be interesting -- since most of the POS machines where I shop aren't setup for ready access by the customer. What do you do -- lean across the cashier to enter your pin?

[jerojero]

About time! And 10 years behind many other countries banking.

[JimGant]

Here's an interesting scenario. Skim the card's magnetic stripe and clone a card with a phony chip. Then, rely on fallback.

The payments industry is observing an extremely high rate of fallback transactions coming from
newly deployed EMV enabled devices. A fallback transaction normally occurs when a chip card, presented at
a chip terminal, cannot be read due to a technical issue with the chip which results in the
technology “falling back” to a magnetic stripe transaction. This situation is not expected to occur
frequently since the chips on the cards rarely fail. In some situations, a fraudster may create a
counterfeit card with an intentionally damaged chip in order to invoke this scenario. For this
reason, fallback transactions are deemed risky by the payments industry. Since the issuer holds liability on fallback transactions,
they may choose to decline them when they are sent for authorization.

[Pib]

Jim,

Good info on the fallback option. I knew older POS machines (non-chip reading capable) could be used to accomplish a transaction on a chipped card if the "card-issuing" bank allows such by allowing Chip & Signature also and just how a merchant has their POS machine setup, but didn't realize some of the other reasons which could cause fallback like a defective chip. From reading info at below link the fallback to magnetic stripe can be caused by various factors like a defective chip, older POS equipment, how the merchant has their POS machine setup or staff trained, etc.

http://www.emv-connection.com/downloads/2012/05/Fallback-Transaction-Guidance-Final-Nov-2015.pdf

Pretty obvious by allowing a fallback option "the sale" to keep the merchant and/or customers happy" takes priority of a more secure transaction which uses the chip. I also expect many of the card-issuing banks and obviously the card networks (Visa/Mastercard) at this point in time of transition to chip cards worldwide still give high priority to ensuring the transaction can occur versus failing if Chip and PIN mode can not be used.

Ultimately, it's still about money/profit made from accomplishing card transactions versus being totally focused on security...guess there has to be that balance allowing the transaction to occur whenever possible with a degree of security versus only using a much higher degree of security...an ever changing balance as technology and people's habits change.

People just need to realize cards with chips "improve" transaction security (does not make it 100% secure) "unless other factors like mentioned above might come into play." Use of chipped cards is only an improvement in transaction security; not the ultimate leap forward that provides 100% security. Preaching to many in the choir I know.

[Pib]

While above talked liability shift for merchant/purchase transactions, below link and partial snapshot talk liability shift dates for "ATM" transactions.

http://pressreleases.visa.com/phoenix.zhtml?c=215693&p=irol-newsarticlePR&ID=1780934