News Forum - Cyber fraud case renews talks over the safety of online banking

[Thaiger]

After at least 40,000 people in Thailand were victims of online banking cyber fraud, the Cyber Crime Investigation Bureau is renewing talks over the safety of such online transactions. The losses recently incurred by those using online banking are thought to be over 10 million baht after hackers stole credit and debit card information. Kornchai Klayklueng, the commissioner of the CCIB, says the initial investigation revealed that hackers possibly used 3 channels to steal such information. The channels included: sending SMS to trick people into giving out their personal information, card holders who had linked their bank accounts with online […]

The story Cyber fraud case renews talks over the safety of online banking as seen on Thaiger News.

Read the full story

[Jason]

Cyber crime is the pariah of the modern age. Investment in counter cyber fraud, is so necessary.

[Dancbmac]

Most of the Thai banks these days allow you to use your phone app to withdraw your money with no fees and no need to use your debit card.  Better security especially if one uses Face ID for your app instead of a pin #.  For years it has always been better to use a credit card for online purchases.  It is tough to stay ahead of these cyber criminals. 

[dj230]

havn't used a debit card in over a decade other than to access my bank account at my bank in canada 

 

hows the fees like in thailand? in canada they charge an arm and leg for using your debit card, like $1-$2 a transaction? although new debit cards in canada have had fraud protection for years now, not sure if thailand has it?

[Blogosopher]

This isn't about online banking, it is about online purchasing. Specifically, using Debit cards. You should make all your online purchases through one 3rd party payment company (PayPal, for example) who charges your account or make payment directly through your bank App without giving out debit/credit card information to many different vendors. If you insist on the convenience of using a Debit card, you can set up a single bank account, with limited funds deposited, to make all your smaller purchases, only transferring enough into that account for your immediate expected needs...therefore exposing a smaller amount of your money to potential fraud. I know someone who lost 40,000 Baht in the latest fraud...I recommended not to have that much money in an account who's debit card information they share directly with many vendors. Less in the account = less exposure.

Edited October 19, 2021 by Blogosopher
added "make" to payment.

[Bluesofa]

13 hours ago, dj230 said:

havn't used a debit card in over a decade other than to access my bank account at my bank in canada 

hows the fees like in thailand? in canada they charge an arm and leg for using your debit card, like $1-$2 a transaction? although new debit cards in canada have had fraud protection for years now, not sure if thailand has it?

I pay 200 Baht a year for my Thai bank debit card that's also my ATM card. No other charges at all.

[JamesE]

45 minutes ago, Bluesofa said:

I pay 200 Baht a year for my Thai bank debit card that's also my ATM card. No other charges at all.

Unless you use an out-of-region ATM, then it's something like 50 baht.

I never understood the logic of debit cards for purchases (other than if you're the bank). There's basically no security, no protection, and no limit to the damage if somebody gets your card data. I'm always running scams on credit card companies so I get two or three new cards a year and none of them is active for more than a year. The numbers on my cards with online vendors who have my CC on file change frequently and the CC company has fraud protection to protect me from unauthorized use. With a debit card the bank would be: "Oh, that's too bad. Can we interest you in a loan until you get your finances back in order?"

[Bluesofa]

7 minutes ago, JamesE said:

Unless you use an out-of-region ATM, then it's something like 50 baht.

I never understood the logic of debit cards for purchases (other than if you're the bank). There's basically no security, no protection, and no limit to the damage if somebody gets your card data. I'm always running scams on credit card companies so I get two or three new cards a year and none of them is active for more than a year. The numbers on my cards with online vendors who have my CC on file change frequently and the CC company has fraud protection to protect me from unauthorized use. With a debit card the bank would be: "Oh, that's too bad. Can we interest you in a loan until you get your finances back in order?"

I agree about the difference with protection between debit and credit cards.

In my case I have no option but to have a debit card as I don't qualify for a credit card here.
I'm not particularly worried though, as the security on Thai debit cards has greatly improved over the past couple of years, with PIN required for shop purchases now, instead of the useless signature verification method that was never, ever checked.
I've mentioned on here before how for ten years I signed my name as Enid Blyton (a UK children's author) just because I could. Twice I signed as Rumplestiltskin.

A couple of years back when you used a card and the staff needed/tried to take your card away to use the machine has disappeared. Petrol stations were one, giving corrupt staff the opportunity to copy your card details along with the three-digit cvv number on the back. They could then make online purchases using your card details.
That was why I obliterated it on my debit card using a black marker, after noting the cvv number elsewhere of course.

[HiuMak]

7 hours ago, Blogosopher said:

This isn't about online banking, it is about online purchasing. Specifically, using Debit cards. You should make all your online purchases through one 3rd party payment company (PayPal, for example) who charges your account or make payment directly through your bank App without giving out debit/credit card information to many different vendors. If you insist on the convenience of using a Debit card, you can set up a single bank account, with limited funds deposited, to make all your smaller purchases, only transferring enough into that account for your immediate expected needs...therefore exposing a smaller amount of your money to potential fraud. I know someone who lost 40,000 Baht in the latest fraud...I recommended not to have that much money in an account who's debit card information they share directly with many vendors. Less in the account = less exposure.

Didn't thailand banks use OTP for debit cards when you do online purchase? Most banks in most countries practise OTP. Some banks even go to extend of MFA or 2FA (whatever that means). If not the thai banks are not protecting its customers.

[Soidog]

I only use my Thai bank card to withdraw the cash I need when cards aren’t taken such as in small shops or bars. I never use it to purchase goods in department stores or supermarkets. For that I either use my Wise debit card (which of course I control the funds on the card) or I use a Monzo card (same exchange rate exactly as Wise) and again I control the amount on that card. Both Wise and Monzo act like a credit card you recharge with funds. Consequently, the most you can lose is what’s on the cards. If you misplace them you can freeze the card from the App on your phone and unfreeze if you find the card again. Wise also let’s you control all kinds of things on the cars such as maximum daily limits on ATM withdrawals, chip & pin payments etc. 

[Thommo]

41 minutes ago, Bluesofa said:

I agree about the difference with protection between debit and credit cards.

In my case I have no option but to have a debit card as I don't qualify for a credit card here.
I'm not particularly worried though, as the security on Thai debit cards has greatly improved over the past couple of years, with PIN required for shop purchases now, instead of the useless signature verification method that was never, ever checked.
I've mentioned on here before how for ten years I signed my name as Enid Blyton (a UK children's author) just because I could. Twice I signed as Rumplestiltskin.

A couple of years back when you used a card and the staff needed/tried to take your card away to use the machine has disappeared. Petrol stations were one, giving corrupt staff the opportunity to copy your card details along with the three-digit cvv number on the back. They could then make online purchases using your card details.
That was why I obliterated it on my debit card using a black marker, after noting the cvv number elsewhere of course.

I also used the strategy of obliterating the ccv on my cc but it would require me to get a new cc later as I am a bit forgetful

[Bluesofa]

2 hours ago, HiuMak said:

Didn't thailand banks use OTP for debit cards when you do online purchase? Most banks in most countries practise OTP. Some banks even go to extend of MFA or 2FA (whatever that means). If not the thai banks are not protecting its customers.

Yes, they do now. I think that's been a couple of years too.

[Bluesofa]

2 hours ago, Thommo said:

I also used the strategy of obliterating the ccv on my cc but it would require me to get a new cc later as I am a bit forgetful

I know what you mean. I have no idea what the cvv numbers are on the three Thai bank cards. I write it all down in my wallet saying cvv and the bank name.
Ha ha! not really. I have a password manager where it's all stored, backed up and copied elsewhere to be sure.

Oddly enough, about half-an-hour ago my wife asked me if I'd seen this news report about cyber-fraud.

[Blogosopher]

11 hours ago, HiuMak said:

Didn't thailand banks use OTP for debit cards when you do online purchase? Most banks in most countries practise OTP. Some banks even go to extend of MFA or 2FA (whatever that means). If not the thai banks are not protecting its customers.

Sorry, can't answer that as I have never used a Thai Debit card for purchases. It is normal practice to use an OTP when you make payment through a bank app or through internet banking. Debit cards, I don't know. Good point and question though.

[DiJoDavO]

"As the new case featured many customers saying their accounts had illegal withdrawals of less than 100 baht" 

Not saying that it's good, but with a few changes, this would be a genius plan. No one mostly minds if something like 30 THB is taken and especially if the transaction was called a fee. The thing that went wrong is that it happened a few times to the same people. 

[DiJoDavO]

What are they going to do about it? More paperwork? Like every other solution? 

Or.... A card, to access a card, to access a permit, to access a document that can give you access to another document, that will help you to apply for another card, that you can use to get a bank card that can only be used once (for safety) to withdraw money at the bank. This doesn't mean that you will get accepted by the bank worker. You might bring along documents which prove your identity, and residence certificate, with copies, which are approved and translated by your embassy. All signed. Also it might require the vaccine and the Covid-19 test. Why? Who knows. But it will be necessary.