DBS Card Skimming Saga - Excerpts from Sunday Times 15/01/2012

[triton]

how many went missing

this is appalling......

[triton]

customers want bank to beef up security

expects bank to beef up security

bank is expected, however, as end users, do we need to play our part? such as changing password?

[triton]

first of all, how did the atm card details get copied @ the machines? second, how did the person managed to get hold of the pin?

if the anti-sklim device works then copying of details should not be possible.

to be able to get hold of both sets of information, it is interesting considering that the camera is 'controlled' by the bank as well. so how the person managed to get hold of the pin?

not one card, but more than 10.

[triton]

change of password advised by the bank. but mainly not many do it. what is the point even if a user changes the password frequently. the time gap when information was stolen and money withdrawn is about 1 month. how often does the bank expects a user to change the pin?

many people are not even aware what to look out for. even if users know that there should be a green color anti skim device, do they know how to tell if it has been tampered? i doubt so.

expects bank to beef up security

bank is expected, however, as end users, do we need to play our part? such as changing password?

[voltshin]

if i'm not wrong this is the 2nd time dbs got "unauthorised withdrawal". 1st time happened many years ago, thereafter they introduced the token device for internet banking.

covering your password is one of the better way to prevent any hidden camera. bank normally don't check the camera unless something happened. you can google "card skimming" and see many way of installing cameras at the ATM. but i also dunno how they got the card details when that green anti skim device are installed.

[Iceheller]

Frankly saying it sounds like a insider job...just my $2.

[triton]

if it is card skimming, it is likely that the ATM is compromised and yet nothing wrong is found on the ATM in concern.

"you are either incredibly smart or incredible stupid" quoted from gene hackman's character in movie - enemy of the state

Source:

Singapore - As DBS branches and ATMs across the island yesterday saw long lines of anxious customers checking if they were among the hundreds of victims who have had thousands of dollars fraudulently withdrawn from their accounts, the Singapore bank said it was "not aware" of any new cases being reported and believes "the situation has been contained".

At latest count, a total of some 400 POSB and DBS customers holding ATM and debit cards have had about S$500,000 fraudulently withdrawn from their accounts over Wednesday and Thursday. Yesterday, the bank assured affected customers that they would be fully compensated by the end of the day.

While investigations are still underway, DBS said in an update yesterday evening "increasing evidence points to the unauthorised withdrawals being part of a card skimming operation".

DBS said preliminary investigations had revealed that two of its ATMs at Bugis Street were likely to have been compromised over three days last November. The transaction patterns of the victims who have reported their cases to the bank showed that a "large majority of these accounts have actually transacted at these ATMs", said Ms Karen Ngui, managing director and head of group strategic marketing and communications.

The bank has since contacted all the 2,726 customers who used the two ATMs during the three days in November and deactivated their cards, it is also having replacement cards issued.

"While investigations are still underway, increasing evidence points to the unauthorised withdrawals as being part of a card skimming operation," said DBS Singapore country manager Sim S Lim. He said DBS knows the locations in Malaysia where the withdrawals were made, and would share them with the police.

The operation took place despite all of DBS ATMs being fitted with anti-skimming devices six years ago, and the ATMs regularly checked by security staff when they replenish the money in the machines.

The Bugis Street ATMs are still in use, as bank staff have checked them and found "nothing to indicate (they are) still being compromised," said Mr Lim.

Card skimming is the stealing of one's personal banking information via a device illegally fitted on an ATM. Along with card fraud - where one's card or card number is used without one's knowledge - and theft of a personal identification number, it is among the most common types of ATM fraud here, according to DBS.

Contacted yesterday, a Monetary Authority of Singapore (MAS) spokesperson said it has been updated by DBS. "The bank is investigating the matter and MAS will review its investigation report," she said. "In a card skimming operation, there may be unusual installation or fixtures on the ATM machines. Customers should alert their bank immediately if they observe unusual installations or fixtures on the ATM."

Asked what was to prevent the scammers from returning to try their luck again, DBS' Mr Lim said: "I think that given what has happened, we know the amount of precaution and amount of alertness has definitely heightened, not just in DBS but probably in all the banks in Singapore. I think it would be foolish of them to come back to try this again."

DBS continually upgrades its anti-skimming devices - mainly supplied by technology firm NCR. "We continue to keep up with the latest in technology to see how we can continually enhance our security," Ms Ngui said, adding that there was no lapse in security in this case.

DBS has also begun sending SMSes to users with any new ATM transactions in Malaysia - a practice that will go on until further notice.

To handle customers' requests and to cope with the higher pre-Chinese New Year traffic, it has deployed more staff, extended branch hours and increased resources at its contact centres.

Asked why DBS did not send out an alert to its customers about the fraud earlier, Mr Jeremy Soo, managing director and head of the consumer banking group in Singapore, said there could be multiple reasons for fraudulent transactions and the bank needed to establish that it was a systemic problem before taking action.

Meanwhile, other Singapore banks are taking precautionary steps to guard against a similar situation and advised consumers to stay vigilant.

"We will continue to review our security measures regularly to ensure that they are current and effective," said Mr Pranav Seth, head of E-Business at OCBC Bank.

A UOB spokesperson said its existing precautionary measures are regular transaction reviews and inhibitors installed at all its ATMs. "In light of the unfolding situation, the bank has also deployed a team to physically check all its ATMs to ensure that no suspicious devices have been placed on any of our ATMs," she said.

[minimerc]

if i'm not wrong this is the 2nd time dbs got "unauthorised withdrawal". 1st time happened many years ago, thereafter they introduced the token device for internet banking.

covering your password is one of the better way to prevent any hidden camera. bank normally don't check the camera unless something happened. you can google "card skimming" and see many way of installing cameras at the ATM. but i also dunno how they got the card details when that green anti skim device are installed.

the token device was requried by MAS for all FI. Even by today's tech standard, these tokens are quite "dinosaurs"... there are also anti "anti-skimming" devices out there.

a word of caution for all especially when u use your credit card overseas, do not let the waiters/waiteress walk away with your credit and bill. You may want to follow the waiter to the cashier for payments and see him swipe the card and return to you on the spot.

[larry88]

it is funny. There was once i went to the bank to place some deposit. DBS has one of the lowest interest rate vs other bank (even vs local banks). When i mentioned that DBS has the lowest deposit rate, the response i got was "but we are the safest"......

[Rolly]

it is funny. There was once i went to the bank to place some deposit. DBS has one of the lowest interest rate vs other bank (even vs local banks). When i mentioned that DBS has the lowest deposit rate, the response i got was "but we are the safest"......

if this claim is true, then we will expect more unauthorized withdrawal to surface at other banks

[triton]

has the bank even apologize for this security breach/lapse?

[minimerc]

Originally Posted by larry88
it is funny. There was once i went to the bank to place some deposit. DBS has one of the lowest interest rate vs other bank (even vs local banks). When i mentioned that DBS has the lowest deposit rate, the response i got was "but we are the safest"......

DBS started using that tagline of being the safest bank after the financial crisis. But honestly by BASEL 3 standard, DBS is not the most "safest" bank here based capital ratio. and the biggest irony was the ATM cases happened a day after ST published a super long interview with DBS chief he has done major cleanup.....

DBS may be the major target for such sydicates as they probably have the highest number of acc opened by "foreign talents" who do not have instant access to acc status info. Any ATM operated may face the same risk...

[monstaR]

DBS started using that tagline of being the safest bank after the financial crisis. But honestly by BASEL 3 standard, DBS is not the most "safest" bank here based capital ratio. and the biggest irony was the ATM cases happened a day after ST published a super long interview with DBS chief he has done major cleanup.....

DBS may be the major target for such sydicates as they probably have the highest number of acc opened by "foreign talents" who do not have instant access to acc status info. Any ATM operated may face the same risk...

I still think DBS is pretty safe as it is 'govt' run and the ability for them to compensate due to any flaws shouldn't be an issue. So it might not be the safest in terms of technology but the may be the safest in terms of stability....

[Ed.YEO]

This incident is not a first for DBS/POSB group!
If you try to recall back, they kenna the same **** couple of years ago. That's when most of the DBS/POSB ATMs gets changed with compact keyboard/touch screen + Greenish card reader machines.

[minimerc]

I still think DBS is pretty safe as it is 'govt' run and the ability for them to compensate due to any flaws shouldn't be an issue. So it might not be the safest in terms of technology but the may be the safest in terms of stability....

your deposits are safe cos they are secured by SDIC, but not banks are equally safe. DBS is partly owned by Temasek, but they are not ran by govt. technically speaking, govt has no obligation to bailout banks cos they are "too big to fail."
regardless, any big corporations (especially banks) will compensate mass public for reputation, goodwill and publicity sake. iirc, SIA paid full compensation for the taiwan mishap even before they commenced investigation, and that instead generated loads of good will and positive publicity.