Phuket Live Wire: Protect yourself from ATM skimming

PHUKET: Recently the Gazette ran a story about ATM skimming, describing how two long-term Phuket residents lost hundreds of thousands of baht at the hands of clever thieves. The banks involved came up with good advice: use ATMs either inside or at the front of bank branches; use ATMs from major banks as they have better anti-tamper systems and beware of people milling about or offering to help with your transactions. But there is much more than you can do, and it isn’t all that difficult.

Phuket’s a magnet for ATM scammers because the island draws lots of well-heeled tourists. People on vacation are less likely to keep close tabs on their bank accounts and if they get ripped off they aren’t likely to stick around to see the judicial process through. The bad guys know it. That means we who live here have to work all that much harder to protect ourselves.

ATM skimming is a world-wide phenomenon, and recently it’s gone very high tech. There’s a series of articles on the advanced toys now in use by computer security guru Brian Krebs at krebsonsecurity.com/tag/atm-skimmer. While most ATM cons rely on the old-fashioned guy looking over your shoulder routine, some are straight out of Buck Rogers.

There’s a card insert in one of Brian’s articles that fits inside a regular ATM card scanning slot: put your card in the bogus slot and as a magnetic stripe reader looks at your card number, a pin-size camera watches as you punch in your Personal Identification Number or PIN, and a Bluetooth connection transmits all of your card information to anyone nearby with the proper mods to a mobile phone. Unless you knew to look for it, you’d never see it. That’s how sophisticated the technology is getting.

Bottom line: No matter how careful you are, there are ways to get your account number and PIN. Of course, you shouldn’t tell anybody your PIN, you should make sure nobody’s watching as you punch in your PIN, you should use ATMs in high profile locations… and so on. You should certainly choose a bank that notifies you by SMS every time your account has a transaction. But in the end, you have to accept the fact that no ATM technology is perfect.

So what can you do? Aside from getting rid of ATM cards entirely (which may be a good option for some people), is there a better way?

A friend of mine has a simple technique that he’s used for years. Here’s how it works.

He keeps two bank accounts, both at the same bank. Both accounts have online access, so he can log on and transfer money between the accounts any time. Both have SMS notification, so he gets an SMS every time more than 5,000 baht moves in or out of the accounts. But only one of the accounts has ATM capabilities.

He keeps a small amount of money – maybe 10,000 or 20,000 baht – in the ATM account. If he needs more cash, he logs on to the non-ATM account and transfers enough to the smaller ATM account, to cover whatever he’ll need.

He keeps most of his money in the account that doesn’t have ATM access. It’s his main account. When people are going to transfer money to him, he has them transfer the money into the non-ATM account. When he sets up automatic payment for credit cards or electricity or telephone, those all go into his main account. The ATM account is just for cash, and it’s only as full as it needs to be.

He’s also very careful about logging on. He uses AI Roboform (roboform.com) or LastPass (lastpass.com) to manage his passwords, and changes his banking passwords frequently. He never logs on from public computers. And he logs on several times a week to both accounts, just to make sure nothing funny is happening with either of the accounts.

Paranoid? I don’t think so. If you have an ATM card issued in a country that has strict banking laws that cover fraudulent use of the card, you’re in luck. But if you need to work with the Thai banking system – where no such laws exist – taking precautions like that are not only reasonable, they’re necessary.

Fortunately, the two people mentioned in the Gazette column last week managed to convince their banks to refund the stolen money. In one case, it took almost a year of complaints and threats of lawsuits by a very tenacious friend to get the money back. The banks involved deserve credit for making things right. But with no specific laws on the books in Thailand, there’s no guarantee that the same thing will happen, should you end up tumbling down this particular rabbit hole.

How does your school use technology?

There’s been a flurry of education-related computer announcements in the past few weeks.

With Woody hunkered down writing a book, the weekly Computer Clinics are taking a new turn. Until Woody emerges with an 860-page copy of “Windows 8 All-In-One For Dummies” under his arm, around May or June, Seth Bareiss will hold computer sessions every-other Wednesday afternoon, from 1 to 3pm. If you have a Windows problem that needs to be solved, drop by one of Seth’s free afternoon sessions at the Sandwich Shoppes. Details in the Phuket Gazette Events Calendar.

Follow him on Twitter: @PhuketLiveWire; “like” pages at facebook.com/SandwichShoppe; and facebook.com/phuketgazette.net.

— Woody Leonhard