Facial recognition to be required for large bank app transactions

[Gaybutton]

I'm not sure how this is going to work, but apparently the banks are going to start requiring facial recognition for transactions of 50000 baht or more via smartphone apps and at ATMs. I think it is going to require a visit to all Thai banks where you have an account to get it set up. If more detailed explanations of how this will work, what you need to do, and the precise date it will begin becomes available, of course it will be posted.

Meanwhile, this is all I've so far been able to find out about it:
________________________________________________________________________

Facial Recognition Becomes a Requirement at Thai Banks for High-Value Transactions

By Adam Judd

4 June, 2023

Financial institutions in Thailand have begun mandating facial recognition for customers conducting high-value transactions. The move, aimed at reducing fraudulent activities and scams, is expected to provide extra security for clients.

Deputy Government Spokesperson Traisuree Taisaranakul announced that all commercial and government banks will implement this new security measure. Starting from July, customers transacting 50,000 baht or more via mobile banking, or whose transactions exceed a daily limit of 200,000 baht, will be required to verify their identities via facial recognition systems.

Traisuree explained that this measure is part of broader anti-cybercrime initiatives spearheaded by the Bank of Thailand (BOT) and other relevant agencies.

Commercial banks have already taken steps to combat online fraud, including no longer sending text messages containing web links to their clients. Mobile banking users can verify their biometric enrollment status via banking apps.

Those who have yet to enroll may need to contact their bank for a facial scan in order to comply with the new regulation.

The preceding is a press release from the Thai government.

https://tpnnational.com/2023/06/04/faci ... nsactions/
_________________________________

Banks tell users: Put on your best face

Explainer: A central bank measure starting in June requires facial scans for mobile transactions of more than 50,000 baht per day

This article was posted April 26, 2023

Bank of Thailand regulations call for biometric authentication of high-value mobile banking transactions as part of measures to protect consumers from cyber-risks.

Banks have notified customers to be ready to authenticate their identities by scanning their faces on their mobile devices when conducting three types of mobile financial transactions, as part of the Bank of Thailand's strategy to prevent financial fraud.

WHAT ARE THE TRANSACTION TYPES?

Under the measures, a facial scan on mobile devices is needed for: mobile money transfers of more than 50,000 baht per transaction to local or overseas accounts; transfers of more than 200,000 baht per day; and to change the limit for credit transfers on mobile devices to more than 50,000 baht per transaction.

In the future, banks can adjust the amount from 50,000 baht that triggers the facial scan requirement in order to fit with their customer types.

Bank customers do not have to scan their faces to transfer more than 50,000 baht to pay bills, such as credit cards, phone bills or stock purchases.

According to the Bank of Thailand schedule, all banks should be ready to introduce biometric authentication for the three types of transactions in June this year.

Some banks such as Bangkok Bank plan to introduce this facial scan requirement next month.

Banks also notified their customers to bring their ID cards to bank counters nationwide to update their information and take a photo of their faces in preparation for the biometric facial scan for the three types of transactions.

HOW WILL THIS MEASURE REDUCE CYBER-RISK?

According to the central bank, the biometric authentication is required for high-value mobile banking transactions as part of measures to protect consumers from cyber-risks.

The regulator set the requirement at 50,000 baht because it found the amount represents only 1% of total daily mobile banking transactions. The requirement should not affect most bank customers as most transactions are less than 50,000 baht.

According to the central bank, it is difficult for fraudsters to create fake biometric information for bank customers because it would require a lot of investment and sophisticated technology.

Banks have standard biometric comparison systems to detect fake biometric identities, said the regulator.

Earlier Bank of Thailand governor Sethaput Suthiwartnarueput said while the measures may be inconvenient for customers, they will increase security for digital banking transactions.

As reports of financial cybercrime spread, the central bank has collaborated with related organisations, both in the government and the private sector, to detect suspicious transactions and deposit accounts.

According to central bank data, from March to December 2022 there were around 50,000 cases of online shopping fraud, 20,000 cases of money transfer fraud, 18,000 cases of lending fraud, and 13,000 cases of call centre fraud. There were 58,000 cases of nominee deposit account fraud with total reported losses of 5.5 billion baht.

The central bank recommends bank customers do not click on suspicious links sent to their Line messaging app or email accounts, nor should they download mobile apps from the unauthorised sources.

People should also not use unsecured mobile devices to conduct financial transactions, according to the regulator.

Bank executives said previously they are continuing to develop cybersecurity systems to prevent financial fraud.

WHAT HAS BEEN THE EFFECT OF A NEW LAW ON CYBERCRIME?

A new royal decree on cybercrime prevention and suppression recently went into effect, giving victims, banks and the authorities more options to fight online scams and other illegal online activities.

The law allows victims of online scams to immediately file for the suspension of mule accounts set up to take advantage of their stolen identity.

Victims can do so through the hotline numbers of 15 banks, as well as file a scam complaint with police stations, physically or online.

The law gives banks the authority to temporarily suspend a suspected mule account, as well as use artificial intelligence technology to investigate illicit transactions.

The law also outlines the punishment for cybercriminals.

https://www.bangkokpost.com/business/25 ... -best-face

[Jun]

My phone has face recognition, probably just like most other members phones.

However, we can usually log into banking apps with a fingerprint, but not the facial recognition. I believe that is because the fingerprints are considered more secure than the facial recognition.

[Gaybutton]

Today I went around to my bank accounts to set up the facial recognition. My first stop was Bangkok Bank. I had to sign a few papers and then they took my photo. We tested it out at the bank and it worked perfectly. When I did a test transaction the phone popped up a frame. I fit my face into the frame. I got a "success" notice and the transaction went right through.

Then I went to do the same at another bank only to be told it won't be necessary. I said I don't understand. I received a message from your bank telling me it is necessary. They said that message went out to all account holders, but foreigners holding an account at their bank won't need to do it and nothing about how you have been doing your transactions will change. Why they didn't tell that in the message, who knows? The message I received was in English, kind of making it obvious the message was going to a foreigner. I've met a great many Thais over the years, but I have yet to meet a Thai who both reads and speaks English, but doesn't speak or read Thai . . .

I went to yet another bank where I have an account and was told the same thing. It does not apply to foreigners holding an account at their bank.

Ok, there you have it. If foreigners don't have to do it, at least not yet. I don't know why they set it up at Bangkok Bank, but that's how it worked today. Maybe at some point later the other banks will require it or at least set it up if you request it. I like it. It is very simple to use and now you don't have to bother with an OTP. A little bit of extra security doesn't hurt a thing.

What nobody explained is why this does not apply to foreigners or why, at least with Bangkok Bank, it does.

Meanwhile, whether you set it up or not, the facial recognition is only for mobile phones. If you are using a desktop computer, whatever you have been doing to make transactions up to now, nothing will change.

For those of you holding Thai bank accounts, I suggest contacting your bank, or better still, go to a branch of your bank to make sure whether you need to set up facial recognition or not. Don't forget to take your smartphone, passbook and your passport with you - your actual passport.

[bkkguy]

My phone has face recognition, probably just like most other members phones.

at least for the Bangkok Bank mobile app setup you don't need face recognition on your phone, you just need a forward-facing camera like you would use for video calls, as GB noted above the bank app handles taking the face image to compare to the one on file

However, we can usually log into banking apps with a fingerprint, but not the facial recognition. I believe that is because the fingerprints are considered more secure than the facial recognition.

the local financial regulators' and banks' idea of best security practices has never been that impressive - the Bangkok Bank app now requires turning off my password manager before use and the Kasikorn app requires turning off WIFI, both claimed this was for "my protection"!

Meanwhile, whether you set it up or not, the facial recognition is only for mobile phones. If you are using a desktop computer, whatever you have been doing to make transactions up to now, nothing will change.

I was told by Kasikorn Bank that the option for transfers of 50,000+ would no longer be supported on the web internet banking site, only in the mobile app, and face recognition setup was required even for foreigners.

I was also told the 50,000+ without face image setup limit on mobiles does not apply to transfers between your own accounts

I have not yet tested either of these statements from Kasikorn, and other banks' rules may vary, so as GB says check with your own bank - but good luck with that, I was given conflicting information by two different branch staff and by call center staff at Bangkok Bank, and conflicting information from emails/SMS, branch and call center staff at Kasikorn.

[Gaybutton]

I was told by Kasikorn Bank that the option for transfers of 50,000+ would no longer be supported on the web internet banking site, only in the mobile app, and face recognition setup was required even for foreigners.

I have an account with Kasikorn, but I did not go there to set up facial recognition because of what took place at my other accounts. Tomorrow or the next day I'll go to a Kasikorn branch and set it up.

I thought the basic rule about facial recognition was going to be a standard for all the banks, but apparently not. Just like immigration - they make up their own rules.

I was given conflicting information by two different branch staff and by call center staff at Bangkok Bank, and conflicting information from emails/SMS, branch and call center staff at Kasikorn.

"Of course dear. What did you expect?"
- Gladys Cooper (Mrs. Higgins), 'My Fair Lady'

And I'm expecting the information I was given today also to turn out to be incorrect. I'm not going to spend a lot of time doing it, but I'd bet if I go to different branches of the same bank I'll get completely different information and sooner or later end up with facial recognition. Anyone care to take me up on that bet . . . ?

[Gaybutton]

Bangkok Bank app now requires turning off my password manager before use and the Kasikorn app requires turning off WIFI, both claimed this was for "my protection"!

That's strange because neither of those have happened to me. None of the apps have asked me to turn off my password manager and none have asked me to turn off my WiFi. The one exception to that was when I first set up my Kasikorn app on my phone. I did have to turn off my WiFi for that, but have had no problem about it ever since.

I guess there is still a lot about how it all works that I don't understand. How does turning off WiFi and using only a mobile internet connection "protect" me and enhance my security? What is the danger about WiFi?

[Gaybutton]

I was told by Kasikorn Bank that the option for transfers of 50,000+ would no longer be supported on the web internet banking site, only in the mobile app, and face recognition setup was required even for foreigners.

We have a new item for my "I Don't Get It" list. Today I went to Kasikorn Bank to set up my facial recognition only to be told the same as the other banks told me - that it is only for Thais, not foreigner accounts. I was also told there will be no changes in the internet app and the transfer limit will be whatever amount I set for myself.

Why it should be entirely different for bkkguy goes beyond me. The only thing I can come up with is it must be some sort of regional rules in which the rules for Bangkok are different from the rules for Pattaya. Whether that is correct and whatever the reasons are - I'm not going to even try to figure it out. If you gents want a crack at it, fine with me.

Now I'm wondering why Bangkok Bank is the only bank, at least where I have accounts, issuing the facial recognition to foreigners. I guess either that's Bangkok Bank's policy or the staff dealing with me simply made a mistake. In any case I'm not going to lose sleep trying to figure out that one either.

At least is wasn't a wasted trip for me. My debit card was about to expire, so now I have a new one. Of course, they charged 300 baht for it, but hey! That's life in Thailand . . .

[Jun]

Of course, they charged 300 baht for it, but hey! That's life in Thailand . . .

Did they ask for cash to pay for the card ?

Last time I renewed mine at Kasikorn, they asked for cash.
I asked for & received a receipt.
I also asked about the regular annual charge, which is supposed to be for the card and they refunded the remaining portion of that. The refund was not cash, but to the account.

All very odd, when cash has the same value as money in the account.
Also, it just creates more pointless administration. Surely all they need to do is keep or adjust the regular annual charge ?

Competition in the banking sector might be another thing for an incoming government to look at.
I don't pay any banking charges in the UK, not for cards, use of ATMS or running the account. I'm sure Thai consumers would like to benefit from a similar fee structure.

[Gaybutton]

Did they ask for cash to pay for the card ?

Nobody asked. The agent told me the fee is 300 baht and I simply handed over 300 baht cash. I also was given a receipt, although I didn't ask for it.

[bkkguy]

None of the apps have asked me to turn off my password manager and none have asked me to turn off my WiFi. The one exception to that was when I first set up my Kasikorn app on my phone. I did have to turn off my WiFi for that, but have had no problem about it ever since.

if I just want to use my password manager in the browser for web pages then no problem, but if I want it to also enter passwords for Android apps it requires an Android installed service and the Bangkok Bank app blocks access if any installed services are active

the Kasikorn app seems to require WiFi off for anything setup or preferences related but not for general balance enquiries, QR code payments, etc

How does turning off WiFi and using only a mobile internet connection "protect" me and enhance my security? What is the danger about WiFi?

there are a number of potential security issues with WiFi, particularly public WiFi hotspots in cafes etc, but 4G/5G connections are not without issues as well, but my desktop PC uses the same WiFi connection as my mobile phone without any WiFi restrictions from Kasikorn!

and a well-designed app should be able to protect against many of these issues anyway - not that I am trying to imply the banks do not have well-designed, secure apps or that they impose arbitrary unjustified restrictions