Hollow assurance

Just days after I had written about my wife's harrowing experience with the fraudulent usage of her credit card in Singapore, Bank Negara Malaysia came out with an assurance that "contactless cards cannot be cloned or used for unauthorised transactions by fraudsters." What bunkum! It's a hollow assurance that cuts no ice with either my wife or me. Neither does it cut any ice with my friend in Kuala Lumpur who had not one by three credit cards compromised.

While fraudsters are running wild in the country stealing electronic data from the newly-issued RFID-based credit and debit cards in the country, this is just a plain old-fashioned denial and misinformation that such electronic theft is impossible, or at the very least, very difficult. The fact that it does occur has been brushed aside. Whatever for? The central bank should request the card issuers in the country to educate their card holders properly on the best way to safeguard their electronic information, not dismiss the threat of theft.

Only thing is, it is not a threat. It happens, because with the proper equipment, skimmers can steal electronic information from as far away as 30 feet. The thieves don't have to stand close to you; they don't have to brush themselves against your body or your bag; standing 30 feet away is as good as standing closer to you.

Beware your new RFID credit cards

Christmas 2016. My wife received a Christmas present on the 25th of December last year. Not quite the sort of present that you would expect on Christmas Day, though. We were just about to leave the Nandaka Vihara Buddhist meditation centre at Cherok Tokun on that day when she received a text message on her mobile at 1.48pm. Two minutes later, another text message came in.

Both SMS carried similar messages: that her credit card had been used for two transactions. Now, the problem was that her credit card was with her, in her purse. She told me about the messages which, at first, I dismissed as a scam message. Then she showed the messages to me and I became alarmed. These weren't scam messages; these were real notification messages from UOB Bank.

I asked her to telephone the Call Centre number on the back of her card. At 2pm, she spoke to one of the call centre staff there to report the incident and immediately, her card was stopped. When we got home, I deduced that the transactions had taken place at the Swissotel The Stamford and my wife decided to call the hotel in Singapore to alert them, even telling the hotel manager of the time that the transactions had taken place.

Not satisfied with these actions, she later called the bank's Call Centre again to seek assurance that her card had indeed been blocked. She also inquired whether a Police report should be made but was told that there wasn't a need for that. However two days later when she spoke to someone at Bank Negara Malaysia's branch in Penang, she was advised to lodge a Police report. So we had one done at the Perda Police station and with this report filed, she then emailed a formal written complaint to the UOB Bank's Customer Advocacy & Service Quality department, with carbon copies to Bank Negara Malaysia and, for good measure, the Consumer Association of Penang too.

Her parting words to UOB Bank's CASQ were, "I shall hope that you will commence investigation immediately to determine how my credit card account came to be debited with these two transactions. I am very concerned and wish to say here that I am not responsible, and shall not be responsible, for these transactions and will not be paying for them." Definitely. Why should she be paying for them when these fraudulent transactions were not made by her?

This was a new RFID-based credit card that she had received not too long ago. The activation of this card was made in September, I think, and since then, she hasn't been making much use of it, preferring to use another credit card that offered her more benefits. So, this card had remained mostly in her purse. How then could her credit card details be stolen? How could her credit card be duplicated or cloned and used physically? Aren't there security features on a credit card that can alert merchants if it is cloned? How do banks account for the unused cards in their possession? How can we safeguard our credit card details in future? During the process of delivering new credit cards to the cardholders, what steps have the banks taken to ensure that the courier service personnel are trustworthy? What sort of measures are there to protect consumers who are victims of fraudulent card usages? These are just a few of the more urgent questions that need to be addressed not only by us, the consumers, but also by the banks and the authorities.

Anyway, on Wednesday, UOB Bank telephoned my wife to inform her that the Swissotel in Singapore has not put in their claims for the two transactions. Presumably, based on my wife alerting them on Christmas Day itself, they might have already taken action on the person or persons who had tried to book themselves into the five-star hotel. I really hope so. And I hope the hotel had also reported the incident to the Police over there. Such frausters should be caught and put away.

As a footnote, I must add that one of my friends in Kuala Lumpur was also hit by this RFID credit card scam recently. Also, my son told me that one of his superiors in the company he's with was also affected. So apparently, my wife's was not an isolated case. We all have to take real good care of the credit and debit cards in our possession as these are now all RFID-based cards.

A second footnote: the Police constable at the Police station told my wife that this was the first such case that had come to her (that is, the constable) notice. Perhaps, victims have not been making reports to the Police. In my opinion, they should because once more reports come in, the commercial crime division may be in a better position to pressure the banks to tighten up on their security measures especially during the delivery process which I suspect may be the weakest link.