Skimming: The new frontier for ATM fraud

SPECIAL REPORT

BANKS are spending millions of baht upgrading ATMs throughout the country and hope to replace all ATM cards with more secure microchipped versions by the end of next year.

The Gazette’s Chutharat Plerin reports.

PHUKET: The FBI reports that this latest form of computer-based financial fraud costs banks and their customers around the world billions of dollars annually.

Its presence has been felt in Thailand, though the national police unit tasked with combating ATM skimmers and the national-level Thai Bankers Association (TBA), have both declined to reveal to the Gazette any figures defining the extent of harm caused in the Kingdom.

Regardless, the problem of ATM fraud, and specifically skimming, has grown so drastically in Thailand that TBA Secretary-General Twatchai Yongkittikul met with Royal Thai Police Deputy Commissioner Aek Angsananont in June to specifically clarify which police unit would be responsible for crimes involving ATM cards.

Immediately after that meeting, Mr Twatchai announced to the press the launch of a mammoth project: all ATMs in the country are to be upgraded and all ATM cards issued by Thai banks are to be
replaced with “smart card” versions fitted with microchips by the end of next year.

“Phuket is a top destination for skimmers,” said Chumpon Donlayamahakomtorn, president of the Phuket Banker’s Club.

“Millions of tourists from many countries visit Phuket each year, which means a lot of international bank transactions are conducted through ATMs throughout the island each day.

“This makes it much harder to track, as tourists might not realize their card has been skimmed until they go home. This is what exactly makes Phuket so attractive for skimmers; they can take advantage of the large volume of people who come and go.”

Mr Chumpon welcomed the huge security upgrade underway.

“All the commercial banks are spending a lot of money to protect their customers,” he said. “Banks are spending millions on the upgrades, even more than the money reported lost by customers being skimmed, but it will protect more customers in the future.”

Wassana Nakchainaramit, senior marketing officer for the Bangkok Bank in Phuket, confirmed that all Bangkok Bank ATMs – more than 8,500 nationwide – have been upgraded.

“All debit cards issued by Bangkok Bank are now ‘smart cards’, with microchips,” Mr Wassana noted. “The old magnetic-stripe cards still work in the machines, but those cards are being phased out.”

SKIMMED ILK

The first thing to do if a person believes his or her card has been skimmed is to contact the respective bank and suspend all transactions, said Col Chainarong Jaroenchainow, a deputy commander of the Economic Crimes Division, the police agency tasked with receiving all complaints related to skimming.

Mr Chumpon agreed, and urged people to keep the call center number for their bank in their phone.
“Call as soon as you think you might have been skimmed. Banks can instantly suspend all transactions related to your account while you’re still on the phone,” he said.

Col Chainarong was very clear that banks were responsible for filing skimming complaints to police as the banks were the actual victims, not the customers.

“They’re the ones whose money has been stolen. They were trusted to keep your money safe,” he said.
“If your local bank does not take any action over your case, you must report the skimming to your bank’s headquarters in Bangkok. If still nothing is done, then report it to us.”

Mr Chumpon, however, said victims must report the crime to the police first.

“You must file a complaint to police, then bring that complaint to us so we can start working with police investigating your case,” he said.

“Don’t worry, the banks are responsible for losses due to card-skimming crimes. The bank will pay the full amount lost, but only after it has been verified that you lost your money by being skimmed.”

Mr Chumpon pointed out that the refund policy for victims of skimming did not apply to people tricked by fake call centers asking victims to voluntarily transfer money to a specific account.

“And anyone caught filing false claims of being skimmed will face criminal charges,” he warned.

TIME BOMB

Col Chainarong noted that most skimmers tend not to use the data they glean from ATM cards straight away.

“People usually think they’ve been skimmed when they realize money is missing from their account,” he said. “But that’s not what normally happens. It could be months, or even a year or more, before a victim’s money is withdrawn.

“Skimmers have to collect the data before they can use it. It can take time to collect enough information to be able to access enough accounts to make it worthwhile.

“That is why changing your PIN number often is the best defense against skimmers. They might have data, but once you change your PIN they can’t use it to take money from your account.”

ANTI-SKIM TACTICS

In addition to the top-line defence of changing PIN numbers often, wisely choosing which ATM to use is one of the best safeguards against skimming, said Mr Chumpon.

“The best choice is to use ATMs in front of banks. There will be CCTV cameras and the machines will be checked very often to ensure that no skimming devices have been fitted,” he said.

Despite an amateur’s best efforts, however, telling whether an ATM has been altered is not an easy task.
In May, Patong Police discovered an ATM fitted with a fake cover over the card-insert slot that was nearly identical to the original, factory-made cover.

The ATM was also fitted with a “new” form of card skimmer that local police and bank staff had never seen before.

“Take a moment to check the ATM before using it,” advised Col Chainarong. “Check that the card slot and keyboard have not been tampered with or have a fake cover fitted over the top.

“If you see a hole above the keyboard or beside the monitor, don’t use the machine.”

Another tactic is to have a second bank account linked to the main account.

“Do not keep too much money in the main account. Just make sure there is enough money there to get you through for the time being,” explained Mr Chumpon.

“That way, as soon as you suspect your primary account has been skimmed, you can quickly move the remaining balance to the second account, which the skimmers cannot access.”

PAUSE FOR EFFECT

Mr Chumpon revealed a new technique to help prevent ATM cards from being skimmed: when removing the card from the ATM, do not remove it in one swift move.

“Skimming devices need a ‘clean swipe’ to obtain the data from the magnetic strip,” he said.

“So you when you remove your card from the ATM, pause halfway through, then remove the card. You could even reinsert it part-way. Anything that breaks the rhythm of a clean swipe. This should help prevent the card from being skimmed when you remove it from the machine.”

— Chutharat Plerin