B.T.W

By Eileen Yu

By the way, ZDNet Asia has more to say

A lesson in card fraud

Posted in By The Way by Lynn Tan on Wednesday, March 21 2007 06:15 PM

Two weeks ago, I received a call from Citibank. Thinking that it was a telemarketer trying to sell me a financial product, I was all ready to say 'no thanks and goodbye' when the lady on the other end of the line said: "Your card has been compromised."

Paranoid by nature, I questioned the caller to ensure she's not a fraudster trying to "phish" for my personal data over the phone. I asked when and where my card was compromised, and found out that it happened during the period straddling November and December last year--when I was on a work trip in Phuket, Thailand.

It was my only trip overseas over those two months, and I had used my card only once at the front desk of the five-star international resort where I had stayed.

According to the Citibank representative I spoke to, it was likely that identity thieves had used a wire-tapping device to retrieve data being transferred through the line that connected the merchant to a central system that processed the transaction.

A security guru also suggested that the fraud could have happened because retailers in Thailand have not switched to chip-based cards and PIN payment mode. They still swipe magnetic strip-based cards, and this made it easier for the customer's personal data to be skimmed and used for malicious purposes.

While most countries in Asia--including Singapore--still widely use magnetic strip cards as a primary mode of payment, credit card companies have been pushing for countries where there are high levels of fraudulent activities, to migrate to chip-based credit cards as these are touted to offer better security.

More recently, though, other security tools have emerged and could also help fight identity fraud. Is chip and PIN the solution? What about the new biometric payment service that Citibank is touting? Could that hold the key to combating card frauds?

Above all, now that I know fraudulent activities can strike anywhere, I've been taking extra precautions. I remember now feeling uncomfortable when the front desk officer at the Phuket resort disappeared into a backroom with my credit card. I should have insisted that he swiped it in front of me--a precaution which the Citibank representative said I should take to ensure my card will not be swiped through a second device which could be used to skim credit card data. What other preventive measures would you suggest?

Disclaimer:
Views and opinions expressed in this blog are the author's, and do not necessarily represent those of ZDNet Asia.

Talkback 4 comments

Fraud crimes will continue to grow until we exploit ID KEY (memory stick) system which will make both the signature and PIN number systems reliable as follows.

ID KEY will activate printer to print ID sticker (small sticker with person's image and name printed on it) which can be attached to the document and countersigned to personalise signature. Chip and PIN system does not make entire signature system reliable the way personalised signature system will and hence is not good enough in combating fraud crimes. Current signature system is like passports without photos and that is why it is so difficult to deter and prosecute fraudsters. Why would anyone get tempted to misuse this system when they know that in the event of crime we will know who they are?

ID KEY will be needed to activate ATMs, Why would anyone get tempted to use stolen or skimmed cards when they know that ATM will not get activated without the use of Card Key Code stored in ID KEY.

Systems like Chip and PIN, biometric ID cards etc. will not make signature and PIN number system at ATMs reliable the way ID KEY system will and hence these systems will only make bad problems worse by diverting fraud crimes to other sectors. It is strange why policy makers are not interested in knowing how ID KEY system will deter fraud crime which is costing us over £20 bn. a year.
Posted by Yogesh Raja on Wednesday, March 21 2007 11:23 PM

arhhh, the same thing hit me also after i did my payment using my citibank creadit card at hardrock cafe at bkk...
Posted by x on Thursday, March 22 2007 08:45 AM

Hi Lynn,
The same thing happened to me while I was living in the US. I had gone to a restaurant for dinner, and used my debit card for payment. I didnt pay attention while the card was swiped. Two weeks later, I went to the ATM and discovered that there wasnt a single cent left in my account. I stood there aghast, staring at the screen. When I went into the bank to report this, the guy behind the counter squinted his eyes and asked me if Id gone to this particular restaurant. I said yes, and he told me I wasnt the first. Apparently, someone at the restaurant is working with the triads, and I received a slip showing many purchases made in HK. Thankfully, my account was FDIC insured and I got back all my money, but not before a person from the bank called me and asked me a long list of inquisitive questions, like whether Id been to HK in the last six months. I told her I hadnt been to HK since I was six. She informed me that the FBI was investigating the restaurant.

There are currently many lapses in credit card security, even with the many measures that are in place. While many of these are exposed in phone or Internet transactions, users do have a role to play, even if its doing a simple thing as keeping an eye on the person swiping our cards.
Posted by anonymous on Thursday, March 22 2007 10:35 AM

mmm...I'll make sure I use card with smart chip next time I'm shopping in Malaysia or Thailand...
Posted by L. Chew on Friday, March 23 2007 10:33 AM

Latest in Blog Central

Subscribe to BlogCentral

Click this link to view this blog as XML.
Add this feed to your online news reader

About the blogger

Eileen Yu

Eileen Yu began covering the IT industry when Asynchronous Transfer Mode was still hip and e-commerce was the new buzzword. These days, she gets stirred up over issues concerning Internet regulation, intellectual property rights and software patents, online privacy and data protection. Eileen is senior editor at ZDNet Asia, where she oversees the business tech news site.