Online Banking Scams in Thailand: Retiree Response Plan

The first minutes after a banking scam are for containment, not for proving exactly who was responsible. Stop the conversation, stop the next payment and reach the bank or Thailand’s official online-scam response before money moves through more accounts.

This guide covers fraudulent transfers, impersonation calls, phishing, one-time-code theft, remote-control applications and suspicious-account restrictions. It does not promise that money will be recovered or decide a bank’s legal responsibility.

Channels checked 29 August 2026. AOC says its service is available through hotline 1441 only, not through social media or another messaging channel. The Bank of Thailand requires financial institutions to maintain dedicated 24-hour fraud-reporting channels. Recheck an institution’s official app, card or website before using a number.

If money or access may still be moving

Do these actions without continuing to argue with the caller:

1. End the call or chat. Do not use a number, link or “case officer” supplied by the suspected scammer.
2. Stop further transfers. Do not send a test payment, tax, release fee or recovery charge.
3. Use an official urgent channel. Call the bank’s fraud line from the official app, card or verified website, or call AOC 1441.
4. Name the risk precisely. Say whether you authorised a transfer after deception, did not authorise it, disclosed a password or OTP, installed an application, shared a screen, or lost control of the SIM or device.
5. Ask for containment. Request the actions available for the affected account, recipient transfer, cards, digital banking and other accounts on the device.
6. Record identifiers. Save the time, staff name or reference, Bank Case ID, recipient details and every instruction.
7. Preserve evidence. Keep the full messages, profile or page URL, phone numbers, files and transaction receipt.
8. Complete police follow-up. Follow the official SMS and case instructions; the hotline call does not replace an investigator meeting when one is required.

If there is an immediate physical threat, call the appropriate emergency service. The Thailand emergency-number checklist separates police, medical, fire and Tourist Police channels.

Choose the channel by its job

Channel	Use it for	What it does not prove
Your bank’s dedicated fraud channel	Immediate account, card, transfer and device-risk containment	That the payment will be recovered or the bank is legally responsible
AOC 1441	Online-scam report, victim-bank identity check, suspicious-account suspension request and connection into the police case process	That a social-media account claiming to be AOC is genuine
Thai Police Online	Official technology-crime report and case follow-up when directed	That filing alone replaces every bank action or investigator appointment
BOT FCC 1213	Advice or complaint about a regulated financial service after or alongside the provider’s process	A substitute for the bank’s urgent fraud channel

Do not call a search-ad number or accept a transfer to a “special department.” Open the bank’s app manually or type the verified domain yourself. A caller knowing your name, bank, balance, transfer or case details is not proof of authority.

Thai Police Online is the official technology-crime portal, but do not assume every non-Thai resident can complete its identity fields directly. If the portal does not accept your documents or you are unsure how to proceed, start with the bank, AOC 1441 or local police and follow the case instructions they give you. Do not use a similarly named legacy domain, advertisement or application.

Prepare for the AOC 1441 process

The Ministry of Digital Economy and Society describes AOC 1441 as a one-stop reporting and coordination centre. Its published workflow says staff collect the victim’s information, connect the caller to the victim’s bank for identity verification, record a Bank Case ID, pass details into Thai Police Online and generate a Police Case ID.

Its published menu directs callers to press 1 to request suspension of a suspicious account, 2 to request review of a suspension on their own account, or 3 for legal advice. Listen to the current recording rather than relying on a saved menu if it has changed.

Prepare:

• victim’s full name and identification details;
• victim bank, account and contact information;
• each transfer date, time, amount and transaction reference;
• each recipient bank, account or wallet;
• the communication platform, profile, phone number and link involved;
• a short chronological account of what happened; and
• a phone that can receive the official case SMS.

The AOC page says the police SMS should be sent within 24 hours and instruct the victim to meet the investigator at the selected police station within seven days. Follow the instructions and dates in the case message you actually receive. Save both case identifiers and ask what to do if the SMS does not arrive.

If the phone may be controlled

A remote-control or malicious application changes the response. The screen you see may not show everything happening, and a caller may be able to observe messages, codes or banking activity.

From another trusted device:

1. contact every bank or payment service represented on the affected phone;
2. explain that remote control, screen sharing, accessibility permission, overlay behaviour or a suspicious installation may have occurred;
3. ask which cards, sessions, credentials and accounts must be blocked or reissued;
4. contact the mobile provider if the SIM, number or text messages may be compromised; and
5. change exposed email and financial passwords only through clean, official channels.

On the affected device, preserve the application name, installation time, permissions, download source, messages and caller details when it is safe to do so. If access may still be active, loss containment comes first: disconnect the device from banking activity and follow the bank’s security instructions. Do not keep opening financial apps to “check” while someone else may control the screen.

Before a later factory reset, uninstall or message deletion, preserve the evidence you can safely retain and ask the bank or investigator what they need. If waiting would allow continuing access, follow the bank’s containment instructions first. A clean reset, operating-system update or official-app reinstall may form part of device recovery, but none substitutes for bank and police reporting.

Describe the transaction accurately

Two events can look identical on a statement but lead to different questions:

• an unauthorised transaction, where another person initiated or impersonated the payment; and
• an authorised payment fraud, where deception caused the customer to initiate the payment.

Do not choose the label that sounds more favourable. Tell the bank exactly who pressed which button, what the screen showed, what information was disclosed and whether another person could control the device.

Bank of Thailand’s shared-responsibility standards cover both categories and set duties for financial institutions and payment providers. They do not create a universal refund. An individual outcome can depend on the facts, evidence, provider compliance, applicable law and investigation. Treat an account suspension as an attempt to contain or trace funds, not as confirmation that recovery will occur.

Build one evidence bundle

Keep original files where possible and organise them by time:

Evidence	Preserve
Transaction	Receipt, amount, date and time, reference, recipient name, account, bank, wallet or QR
Contact	Full phone number, email, profile URL, username and platform
Conversation	Complete chat export or screenshots with dates and surrounding context; voice notes and call log
Device	App name, store or download source, permissions, installation time, remote-access or screen-sharing details
Bank response	Time called, official channel used, staff or branch, action requested, Bank Case ID and written confirmation
Police response	Police Case ID, SMS, station, investigator, appointment and documents submitted

Do not crop away the account name, timestamp or URL. Keep a working copy for sharing and an untouched original. Redact passwords, OTPs and unrelated private information from copies sent to anyone who has not established a need for them.

If more than one bank or transfer service was involved, give each provider the complete route. A first recipient may not be where the money ended.

When your legitimate account is restricted

A blocked app or account is not proof that the customer committed fraud. Bank of Thailand says banks use Central Fraud Registry and other information to manage accounts associated with police reports, unusual behaviour or suspected mule activity. Electronic channels may be suspended until enhanced identity verification is completed.

Use the bank’s official contact channel or branch and ask:

• what function is restricted—incoming funds, outgoing funds, cards, app access or the whole account;
• whether the restriction is based on a police complaint, registry information or the bank’s own detection;
• what identity and transaction evidence is required;
• whether an AOC or police case number is attached; and
• which written escalation or complaint route applies.

If you are an uninvolved recipient whose transaction has been suspended, the current BOT route is AOC 1441, press 2. Be ready to provide the requested name, bank, affected account number and identity details. BOT describes a target of four hours to one day, depending on the three daily AOC-to-bank data cycles; treat that as an operational target, not a guaranteed release time.

Preserve the bank’s notice, affected amount and case reference. BOT says the notice should distinguish a transaction suspension from a police or legal account freeze, because the legal effect and next step are different. When a police report or designated case is attached, continue through the bank, AOC and assigned investigator as directed. Do not pay an intermediary who claims they can remove a restriction.

If the provider’s handling remains unresolved, BOT FCC 1213 is a financial-service advice and complaint channel. It is not the first urgent call when money is still moving.

Set safer limits before a crisis

The Bank of Thailand’s customer-profile framework groups daily mobile- and internet-banking transfer limits broadly as:

Profile tier	Digital transfer or payment limit
S	Not more than 50,000 THB per day
M	Not more than 200,000 THB per day
L	More than 200,000 THB per day

Banks can use more detailed tiers and assign limits from normal behaviour and the information they hold. Older customers are not automatically placed at 50,000 THB. The official FAQ says older customers who normally transfer no more than that may be assigned the S limit, while customers can ask the institution to review a limit or provide a temporary increase for a verified need.

For an urgent request to increase a digital limit, the same FAQ says the institution should communicate its decision within two to three hours. That is a decision window, not guaranteed approval or a guaranteed higher limit. Plan a legitimate large transfer early enough to complete the bank’s checks without pressure.

Use the framework as a safety control:

• keep the everyday limit below the largest plausible scam payment;
• raise it through the official bank process only for a transaction you have independently verified;
• reduce it again after the need passes;
• maintain a separate reserve account without everyday payees or payment cards where practical;
• enable official app and transaction notifications;
• review registered devices and contact details with the bank; and
• make a second-person pause rule for new recipients or unusually large transfers.

Bank of Thailand’s fraud controls also include one-device mobile banking for each bank, facial verification for specified transactions and restrictions on financial-institution messages with attached links. Do not treat an unexpected link as safe because the sender name resembles a bank. Open the official app independently.

For account opening, contact maintenance and access planning, use the Thai bank-account guide. For exchange and transfer-provider checks, use the sending-money guide.

Avoid the recovery scam

After a loss, case information may be used to make a second approach sound convincing. Thailand’s Ministry of Digital Economy and Society warns about imposters presenting themselves as police, state agencies, lawyers or recovery services, promising complete recovery and demanding payment in advance. No official process can guarantee that every loss will be recovered.

Stop if someone requests:

• a recovery deposit;
• tax or insurance before funds can be returned;
• a wallet seed phrase, OTP, PIN or remote access;
• secrecy from the bank or police;
• payment to unlock a frozen account; or
• an advance fee based only on knowing details of the original case.

Verify any adviser, authority and payment instruction independently. A legitimate professional may charge for genuine advice or representation, but a fee does not guarantee recovery. The ministry says government recovery does not require an extra recovery payment. The more urgent and secret the promise, the more important the pause.

If the scam began through a relationship, the romance-scam response covers emotional pressure and verification without shame. If it involved property, shares, cryptocurrency or guaranteed returns, use the property and investment due-diligence guide.

The bottom line

After an online banking scam in Thailand, speed and accuracy matter more than embarrassment. Stop the contact, reach the bank or AOC 1441 through an official channel, secure every affected account and device, preserve the evidence and complete the police follow-up.

Then reduce the next risk: lower routine limits, verify new recipients through a second channel and keep large reserves away from the device and account used for everyday payments.