Local Credit Card Theft

[FolkGuitar]

We've received notice from both American Express and Visa than my cards have been used by someone else in the past month! I ONLY use these cards in two supermarkets here in Chiang Mai, never on line or in other shops, but 'somehow,' charges have shown up this month for several on-line purchases and hotel bookings, none made by us. Fortunately, both credit card companies are on top of it, and we won't be charged for these purchases. There is NO QUESTION about the fact that these card numbers were harvested by someone at one of these supermarkets. I have anti-skimming plates inside my wallet, so we know that no one is scanning them while standing near me. I shop at odd hours and no one has even been standing on line near me when I check out.

I suppose I can say that one is close to the Airport and the other is off Chang Puak Road, and the supermarkets themselves are NOT to blame. But there is someone working there who is making money. I doubt that mine are the only cards to be stolen. I'm going to both shops today to let the management know what is going on.

[NancyL]

Wow, thanks for the heads-up. This is one reason we use U.S. credit cards, because we know we have protection when something like this goes wrong. Also, this is why we're set up to look at our account activity on-line. I make it a point to log-in and look at charges every few days to signs of suspicious activity. Like you, FolkGuitar, we're just using them at grocery stores and hospitals here. Certainly nowhere that they leave our sight and in places you'd consider to be very reputable.

[hml367]

FolkGuitar,

If you don't mind me asking, are you aware what part of the world the online charges were made?

[lopburi3]

I really do not understand why anyone uses a foreign card for supermarket payment here (and foreign fee/exchange rate issues). I find it a good source of small bills for taxi and such. Cash is accepted everywhere - if you must use plastic some local cards offer SMS alerts when used which would immediately alert you of any fraud and do not involve exchange/foreign usage loss.

[Diplomatico]

"There is NO QUESTION about the fact that these card numbers were harvested by someone at one of these supermarkets."

I wouldn't be so certain about that. There are several ways your card information could have been obtained that had nothing to do with someone at the supermarket itself:

Someone could have remotely installed malicious software on the company's POS devices, someone could have hacked the firm that does the credit card processing between the stores and the banks, someone could have hacked your bank's database, etc.

Nice that your credit card issuers are on the ball, though. Bit of a hassle since they'll cancel/replace your cards but much better than the alternative.

[FolkGuitar]

The charges were made to Thai companies.

Lopburi, we use Japanese credit cards because we get the best rates and the best service from them. Rather that SMS alerts, the company calls us with any suspicious buying action. With these two cards having only been used at the same two supermarkets once a month for the past three years, the spurious charges were immediately flagged and we were called.

[hml367]

Thanks, FG.

The reason I asked is I had a credit card from Hawaii that I had used sparingly in Thailand for years and never had a problem. A couple years ago I went to Hawaii and used the card for some dinners.

When I returned to Chiang Mai I found out my financial institution had blocked the card because of suspicious activity. They were very minor charges from New Mexico. I had to have a new card issued. The only hassle with that is changing the card information for online use in the USA.

Glad you got taken care of by your companies.

Edited May 18, 2016 by hml367

[Farma]

In the past 3 weeks 2 Thai acquaintances in Issan have had unauthorized charges made against their cards too. The cards were from different banks. 1 Kasikorn and the other Bangkok bank.

2 of the charges were made in US$ from web sites in Hawaii.

[NancyL]

Lopburi -- we use our foreign credit card because it gives a very good exchange rate, has a low service fee for foreign charges and the credit union that issues the card gives back their earnings each year to their members based on "account activity" and that includes the money we churn thru the credit card issued by this credit union. It's actually cheaper than bringing money into Bangkok Bank via ACH transfer. That being said, we do have one of Hubby's pension coming into Bangkok Bank via direct deposit, but the U.S. credit card is used for some of our expenses with his other pension being deposited in the U.S.

I realize this isn't "normal" for a credit card issued for a bank, but it really doesn't make sense for anyone over age 55 to be doing their banking thru anything but a credit union in the U.S. anyway.

[Mark123456]

I really do not understand why anyone uses a foreign card for supermarket payment here (and foreign fee/exchange rate issues). I find it a good source of small bills for taxi and such. Cash is accepted everywhere - if you must use plastic some local cards offer SMS alerts when used which would immediately alert you of any fraud and do not involve exchange/foreign usage loss.

If I withdraw cash from my UK bank account I have to pay 2% foreign exchange commission + a £1 fee from my bank + a 200 baht fee from the local bank. If I buy something in a shop with the same card, I pay the 2% foreign exchange commission but not the £1 or 200 baht bank charges. I use my card for supermarket payment here because it's cheaper. (I do pay a foreign exchange fee but I've never had any foreign exchange 'issues').

[OccamsRazor]

You now have another opportunity for credit card theft - Swipe it: 7-Eleven to accept credit cards

[FolkGuitar]

"There is NO QUESTION about the fact that these card numbers were harvested by someone at one of these supermarkets."

I wouldn't be so certain about that. There are several ways your card information could have been obtained that had nothing to do with someone at the supermarket itself:

Someone could have remotely installed malicious software on the company's POS devices, someone could have hacked the firm that does the credit card processing between the stores and the banks, someone could have hacked your bank's database, etc.

Nice that your credit card issuers are on the ball, though. Bit of a hassle since they'll cancel/replace your cards but much better than the alternative.

I would like to believe that anyone clever enough to remotely install malicious software on the company's POS devices, or hack the firm that does the credit card processing, would be smart enough NOT to use the stolen card to reserve a Thai hotel room, or order mail-order delivery of a custom-made wet-suit from a Thai company, as this thief did... What ever the manner of garnering the numbers, who ever was responsible should be in police custody shortly.

Seems to indicate a young, stupid crook.

[KhonKaenKowboy]

yawn. US bank..no annual fee, chip protected, 12 ways to set notifications of use, locations, etc..gave me 35.36 to the USD this week, and if I spend 750 USD in the first three months I get enough miles for a one way ticket from DC to BKK....others prefer to do things the hard way.

[orang37]

Sawasdee Khrup, Khun FolkGuitar,

Commiseration is !

It does sound like you have used beyond-average-mortal due diligence in carefully protecting your hoard. As you may remember, I recently went through a similar experience; since, in my case, the unauthorized payments were made to on-line companies outside Thailand, I had not thought about a possible local source, but I bet I use my credit card at the same supermarket you do.

While there's nothing "redeeming" about getting your credit-card abused, I can say I am quite satisfied with how Bangkok Bank handled the theft, and it was easy to get a new BB card. Perhaps lucky that I had my mobile turned on, and at hand, when the unauthorized payments were made, and got the SMS notification, and acted quickly: since, often, I do not even turn on my mobile for days (people I want to talk to know how to use Skype.

wishing you the blessings of calm heart, and clear mind, I remain, ~o:37;

[FolkGuitar]

Really, the only damage on our end is that we have to wait a week before having new cards... and I had no plans to shop at either supermarket for the next 2-3 weeks. But the credit card companies absorb the loses, which, like most crime, eventually will trickle down to the public paying more for goods and services in the long run. I have other cards that I use for on-line and local purchases that weren't compromised. I like to keep financial transactions compartmentalized.

[Fookhaht]

After living here for three years, I used my US credit card for the first time at a shoe shop at Central World in Bangkok. In a few weeks, charges showed up for $4000 in Paris, France. I had not used my credit card at any other place.

It took me three months and $250 to resolve the problem: Phone calls, police reports, but mostly the cost of sending documents to the USA.

The experience taught me to use my credit cards sparingly In SE Asia.

Caveat Emptor.

[luther]

I wouldn't bet against malware installed in the stores. A recent free check of restaurants in a town I frequent in the US found almost half of the cash registers had malware for appropriating CC data. Don't discount it because the CC was used to buy stuff in Thailand. Stolen credit info is auctioned online seconds after it is stolen and is often purchased by people or bots close to where the credit card has been frequently used. It's much more sophisticated than most people think.

About half the people I know have not bothered to go online and check the boxes that give them automatic SMS or email alerts when their credit card is used. It's a no brainer.

KohnKaenKowboy,..."and if I spend 750 USD in the first three months I get enough miles for a one way ticket from DC to BKK"

What card offers that?

[luther]

I wouldn't bet against malware installed in the stores. A recent free check of restaurants in a town I frequent in the US found almost half of the cash registers had malware for appropriating CC data. Don't discount it because the CC was used to buy stuff in Thailand. Stolen credit info is auctioned online seconds after it is stolen and is often purchased by people or bots close to where the credit card has been frequently used. It's much more sophisticated than most people think.

About half the people I know have not bothered to go online and check the boxes that give them automatic SMS or email alerts when their credit card is used. It's a no brainer.

KohnKaenKowboy,..."and if I spend 750 USD in the first three months I get enough miles for a one way ticket from DC to BKK"

What card offers that?

[mesquite]

FG, did the cards have chips in them?

[KhonKaenKowboy]

I wouldn't bet against malware installed in the stores. A recent free check of restaurants in a town I frequent in the US found almost half of the cash registers had malware for appropriating CC data. Don't discount it because the CC was used to buy stuff in Thailand. Stolen credit info is auctioned online seconds after it is stolen and is often purchased by people or bots close to where the credit card has been frequently used. It's much more sophisticated than most people think.

About half the people I know have not bothered to go online and check the boxes that give them automatic SMS or email alerts when their credit card is used. It's a no brainer.

KohnKaenKowboy,..."and if I spend 750 USD in the first three months I get enough miles for a one way ticket from DC to BKK"

What card offers that?

look at American Airlines frequent flyer page.

[FolkGuitar]

FG, did the cards have chips in them?

The Visa card did, the American Express did not.

[KhonKaenKowboy]

In addition to checking balances and alerts, I also check www.creditkarma.com for things like score/balances/inquiries...you think someone making a charge on your card is bad? How about someone that set up an entire account without you knowing about it...then you are looking at an identity theft situation that would really suck. While checking your scores is free and considered a "soft check," a true application will count as a "hard check," and minimally affects your score, that is a good thing to monitor, too. Lately, they are rejecting some people, who ae gaming the frequent flyer promos, even though they have perfect credit, but you can still do (I recall) six every two years. If you're getting ready to obtain a mortgage, then you need to use a little bit different strategy, as ratios will become very important, and hard inquiries can be more of a deal breaker, because they will think you were recently rejected and that will raise a red flag...and of course the SOBs collude, so you can't shop around too much on rates and points.

Edited May 18, 2016 by KhonKaenKowboy

[JimGant]

FG, did the cards have chips in them?

Wouldn't have made any difference for online ("card not present") purchases. But many (not all) online merchants require that you furnish the 3-digit CVV number -- and this number can't be harvested from the mag stripe. So, the clerk would have to turn the card over and memorize the three digits; I'd be suspicious if the clerk's eyeballs fixated on the card, particularly the backside, for any duration.

Having said that, I've yet to see a clerk compare your signature on the charge slip with the signature on the back of the card -- just doesn't happen in Thailand (nor in the States, for that matter). But they'd certainly be in their rights to do so. However, since it rarely (never) happens, I'd be suspicious if out of the blue a clerk held up the charge slip and compared the signature with the back of the credit card -- where, of course, the CVV number resides right next to the signature.

FG, anything like this happen with you?

[JimGant]

It took me three months and $250 to resolve the problem: Phone calls, police reports, but mostly the cost of sending documents to the USA.

Who is your card issuer? Most large banks will just close the account, eat the $50 max allowed charge, and issue a new card. And why a police report (and about what and whom)? You indicate the card was just skimmed, not stolen...

[FolkGuitar]

FG, did the cards have chips in them?

Wouldn't have made any difference for online ("card not present") purchases. But many (not all) online merchants require that you furnish the 3-digit CVV number -- and this number can't be harvested from the mag stripe. So, the clerk would have to turn the card over and memorize the three digits; I'd be suspicious if the clerk's eyeballs fixated on the card, particularly the backside, for any duration.

Having said that, I've yet to see a clerk compare your signature on the charge slip with the signature on the back of the card -- just doesn't happen in Thailand (nor in the States, for that matter). But they'd certainly be in their rights to do so. However, since it rarely (never) happens, I'd be suspicious if out of the blue a clerk held up the charge slip and compared the signature with the back of the credit card -- where, of course, the CVV number resides right next to the signature.

FG, anything like this happen with you?

No, I couldn't say that I remember any check-out staff actually looking at the card. For certain, none ever looked at my signature. In fact, it's my habit to sign the card with the names of famous TV private detectives from the past; Jim Rockford, Sam Spade, Joe Manix, Richard Diamond, etc., etc. I guess the credit card companies never look at the slips either...

[elektrified]

yawn. US bank..no annual fee, chip protected, 12 ways to set notifications of use, locations, etc..gave me 35.36 to the USD this week, and if I spend 750 USD in the first three months I get enough miles for a one way ticket from DC to BKK....others prefer to do things the hard way.

Who cares about U.S. banks. This is not America and many of us don't bank there.

[KhonKaenKowboy]

Visa being an American company might be somewhat relevant, and I'll take 1000 USD free plane tickets over a free umbrella or tote bag any day of the week. But....as stated, the hard way often has appeal here. Maybe it's the feeling of martyrdom or a chance for some of the older people to tell their amazing story, that has often already been told 5000 times.

[JimGant]

No, I couldn't say that I remember any check-out staff actually looking at the card.

Probably, then, the online merchants the crook used didn't require the CVV number.

Actually, there's no reason to have the CVV number visible on your card -- just remember what it is, then scratch it out.

[northernjohn]

Had to laugh at the people talking about them not looking at the signatures. A long time ago I knew people who were forging checks. Some of them signed them you have been <deleted>---d.

Here every now and then I will just give my foreign credit card to the wife to pay for some thing while I am talking to some body. Never a problem with it. She can't write English so she does it in Thai.

I have to agree that the tech is so far advanced now that they need never see your card to use the number. They can tap into many different places.

[FolkGuitar]

Visa being an American company might be somewhat relevant, and I'll take 1000 USD free plane tickets over a free umbrella or tote bag any day of the week. But....as stated, the hard way often has appeal here. Maybe it's the feeling of martyrdom or a chance for some of the older people to tell their amazing story, that has often already been told 5000 times.

... and you, for some reason, believe that only American-issued credit cards can get free mileage? ROTFL!

Let me introduce you to the 21st Century. There is a very big World outside US borders, and quite a lot of it has indoor plumbing.