Scams and frozen accounts in Bangkok: one law does both ends

The instrument that can freeze a fraudster’s account within the hour is the same instrument that can freeze yours because money passed through it on the way. Both ends run on clocks — except the end you are most likely to meet, which has no clock at all. Here is how the machinery is actually written, and what each deadline in it is for.

Compiled by the Town Wire News desk · Last verified October 2026 · How we made this

One decree, two ends, and they are not the same size

Thailand’s answer to online fraud arrived as an emergency decree in March 2023 and was substantially rebuilt in April 2025. It is short — the original ran to fourteen sections — and it does something unusual: instead of creating a fraud offence, which the criminal law already had, it rewires the plumbing. It puts a duty on banks to tell each other things, a duty to stop transactions, and a set of deadlines on the officials who then have to decide what to do.

Reading it end to end, the striking thing is that it has two doors and they are built to different specifications.

The first door is the one you go through when you are the victim. It is fast, it is generous about how you can use it, and every deadline in it runs in your favour: if nobody does anything, the freeze comes off.

The second door is the one you find yourself behind when somebody else was the victim and the money touched your account on its way through. That door also has seven-day clocks on it — and then, since April 2025, it has a second lock with no clock on it at all.

Most English-language writing about this subject describes the first door. Most of the people who need it are standing at the second.

If you are the one who lost the money

Section 7 is the victim’s provision, and it is worth knowing in its actual sequence because each step has a job.

When the institution is told by the account holder that a transaction on their account is connected with technology crime, it must suspend that transaction temporarily, enter the information into the shared disclosure system so that every institution further down the transfer chain knows and suspends immediately, and tell the victim to complain to an investigating officer within seventy-two hours. Once the complaint is made, the investigating officer notifies the institutions and must decide about the accounts within seven days of the complaint. If no order to continue the suspension is made in that time, the institution cancels it.

The chain propagation is the part that makes speed matter. Fraud proceeds do not sit in one account; the whole design of a mule network is to fan the money outward through several layers within minutes. The decree’s answer is that a single notification propagates down every branch at once, so the value of reporting in the first hour is much higher than the value of reporting on the second day.

And you do not have to be anywhere in particular to do it. Section 8 provides that notice under sections 6 and 7 may be given by telephone or by electronic means. It then adds a requirement most people never invoke: where the notice is given by telephone, the person receiving it must record it in writing, sign it, note the date and time as evidence — and send a copy to the notifier to keep as evidence too.

Ask for that copy. It is the only document that will exist showing what you said and when you said it, and the seventy-two hours runs from a moment that otherwise leaves no trace.

The hotline is not a helpline — it is a complaint

The 2025 amendment created a body called, in its Thai abbreviation, ศปอท. — an operations centre for the prevention and suppression of technology crime, housed inside the permanent secretary’s office of the digital economy ministry. Section 8/5 lists nine powers, and the first one changes what a phone call is.

The centre receives reports of suspected technology crime from victims — and such a report is deemed to be an electronic complaint under the second paragraph of section 8. In other words the call is not a step before making a police report. It is the police report.

The public number for online fraud is 1441, which the government describes as running twenty-four hours and which was expanded from twenty lines to a hundred, with the stated aim of freezing a suspect account within an hour. Put those together with section 7 and you get the practical sequence: one call can both start the suspension and satisfy the seventy-two-hour requirement.

Two cautions, both real. First, a hotline that everybody has been told to trust is an obvious thing to impersonate, and Thailand’s official anti-fake-news centre has published a warning that criminals do exactly that — calls claiming to be from 1441. Anything inbound claiming to be the anti-scam line is subject to the same rule as anything else inbound: hang up and dial the number yourself. Second, we could not open the hotline’s own site from where we work, so we cannot tell you first-hand what its menu tree offers or whether it operates in English, and we are not going to guess.

The clocks that let go, and the lock that does not

Now the other door.

Section 6 covers the case where the bank itself spots something, or is told through the shared system, that an account is being or may be used for technology crime or for money laundering. The institution must suspend the transaction, tell the next institution in line, and push the information into the shared system so that every downstream recipient suspends too — immediately, temporarily, and for not more than seven days from the day the suspicion was found or notified, while a criminal officer or the Anti-Money Laundering Office verifies.

Then three sentences that matter a great deal. If the check turns up evidence that the account was used in an offence, they must proceed under the law within seven days. If it does not, they must notify the institution so the suspension is cancelled. And — the fourth paragraph — once that period has passed, if the officer or the Secretary-General does not report the result at all, the institution must lift the suspension.

That is a genuinely well-drafted default. Bureaucratic silence does not extend the freeze; it ends it. If your account has been frozen under section 6 and nothing has been communicated to anyone in over a week, the decree is on your side and you should be saying so in those terms.

The problem is section 4/2, which the 2025 amendment inserted, and which does not work like that at all.

Once the operations centre publishes a person’s name, or a digital asset wallet number, under section 8/5(6), every financial institution and business operator must refuse to open an account, suspend the service or the transaction, or close the account with that person — and it must keep doing so until the listing is revoked. There is no seven-day limit. There is no silence rule. There is no deadline running against anyone. The only thing that ends it is an affirmative act by the body that started it.

The centre does have the power to undo it: section 8/5(2) lets it revoke a suspension where the account is proved unrelated, and section 8/5(6) covers revoking a listing as well as making one. But the difference in architecture is the whole point. On the victim’s side, doing nothing releases. On the listed side, doing nothing holds.

Why September 2025 happened

In the second week of September 2025, Thai banks suspended roughly ten thousand accounts in five days. A review of more than a hundred contested cases on 14 September released eleven of them — about one in ten. Social media filled with complaints, and the group making the most noise was not the people who had been defrauded but market vendors whose accounts had frozen after they took a payment. Some of them stopped accepting QR codes and bank transfers altogether, which in a city that had spent five years moving onto PromptPay was a visible step backwards.

The response came on 15 September: the Bank of Thailand and the Thai Bankers’ Association undertook to unfreeze innocent accounts within four hours to one working day, against the three to seven days then being reported, and said a system for automatic proactive unblocking was about a week away. The cyber police said they would revise the criteria for freezing to reduce the impact on innocent people.

Why did it happen at all? Look at what the April 2025 amendment did to the incentives.

Section 8/10 provides that financial institutions, business operators, telephone network providers, other telecoms providers, other related service providers or social media service providers share responsibility for the damage caused by technology crime — unless they can prove that they complied with the prevention standards set by the Bank of Thailand, the Securities and Exchange Commission, the broadcasting and telecommunications commission or its office, or the electronic transactions commission. The burden is on the intermediary, and the defence is compliance.

Section 8/11 then fines an institution up to 500,000 baht for failing to act on a listed name under section 4/2, and where the failure came from the direction or the inaction of a director, manager or responsible person, exposes that individual to up to a year or 100,000 baht.

Now read the decree looking for the mirror image — a penalty, a compensation duty, anything at all attaching to an institution that suspends an account which turns out to be perfectly clean. There isn’t one.

This next sentence is our reading and not a finding in any of these documents: a system that punishes under-freezing, offers compliance as the only defence, and is silent about over-freezing will produce over-freezing, and it will produce it immediately after the rules change rather than gradually. We think that is what the autumn of 2025 was. We flag it as an inference because no instrument says it and no official body has said it either.

Two kinds of frozen, and they need different phone calls

If your own account stops working, the first job is to work out which of two completely separate systems has stopped it, because from the customer’s side they are indistinguishable and the way out is different.

The first is a suspension under this decree: money linked to a reported fraud somewhere upstream passed through your account, and the chain propagation in sections 6 and 7 reached you. You may well have no idea who any of the parties are. The published route for an innocent holder is to call 1441 and press 2, the option set up for exactly this; formally, section 8/5(2) lets the operations centre revoke the suspension where the account is shown to be unrelated, and section 8/2 gives a person connected to a published account ninety days from the Royal Gazette notice to file an objection with evidence.

The second is not this decree at all. It is ordinary customer due diligence: a passport that has been renewed, a visa that has changed class, an address record that no longer matches, a periodic re-verification that you did not answer. Banks block accounts for that routinely, it implies nothing about wrongdoing, and it is fixed at a branch with current documents. We wrote about the machinery behind it in opening a Thai bank account, where the operative concept is residence and the paperwork exists to lower a risk score.

Asking the branch which of the two it is will not always get you a straight answer, and there is a reason for that beyond unhelpfulness. Section 12 of the decree takes disclosure, exchange, access, collection, storage and use of personal data under the decree outside the personal data protection law — while forbidding anyone holding that data to pass it to a person without a related duty. So the bank can lawfully share information about you with other banks, and is constrained about sharing it with you.

Getting money back, without suing anybody

Before April 2025 the honest answer to “will I get it back” was that the money might be frozen but releasing it to you meant litigation. The amendment built a different route, in sections 8/1 to 8/4, and it runs through the Royal Gazette rather than a courtroom.

The police, the Department of Special Investigation, or the institution itself report technology-crime transactions to the Anti-Money Laundering Office. The office checks the report, and then publishes the account details in the Royal Gazette. That publication does two jobs at once: it tells victims to file a claim with evidence of their loss, and it tells anybody connected with the account to file an objection with evidence that the money is unrelated. Both have ninety days from publication. Where a victim is clearly identified, they must also be told directly.

The claims then go to the Transaction Committee constituted under the anti-money-laundering law, which has power to order the money returned to the victim. If you disagree with what it decides — on either side of it — you petition the Civil Court within thirty days of being notified, with the asset provisions of the anti-money-laundering law applying by analogy, and the Court of Appeal’s judgment is final.

Section 8/4 handles the residue: if nobody claims within ten years of the ninety-day deadline, or money is left over after the refunds, it falls to the anti-money-laundering fund — but an owner who can show a proper reason for not having come forward in time may still get it back afterwards.

Two practical observations. Ninety days is not long if the notice is a Gazette entry in Thai that you were not expecting, which is why the direct-notification duty matters and why anyone with a live case should be asking whether their account has been gazetted. And the same ninety days is the objection window — so if your money has been caught up in someone else’s case, that clock is running for you too, in the opposite direction.

The mechanics beneath this — the exact form of claim, the channels, the timetable — are left by the decree to ministerial regulations. We were not able to locate those, and this page therefore describes the statutory shape rather than the paperwork.

The offences that reach ordinary people

Most of the decree is aimed at criminals. Three provisions are aimed at conduct that an ordinary resident might not recognise as criminal at all.

Section 9 — lending the account, or the number. Opening, or allowing another person to use, your deposit account, electronic card or electronic money account without intending to use it for yourself or for a business you are involved in; or allowing another person to use or borrow your mobile telephone number — where you know or ought to know it will be used for technology crime or any other criminal offence. Up to three years, or up to 300,000 baht, or both.

Three things there deserve slowing down for. The standard is constructive: ought to know, not knew. The mobile number sits in the same sentence as the bank account, so lending a SIM to somebody who cannot register one themselves is squarely inside the section. And the object of the knowledge is “technology crime or any other criminal offence” — it is not limited to online fraud.

This is the provision that turns a favour into an offence, and the favour usually looks reasonable at the time. A colleague whose own account is blocked asks you to receive a payment. A friend without the right documents asks to use your number for a registration. Somebody offers to pay you to receive and forward a transfer. That last one is not a grey area at all.

Section 10 — and the numbers go up sharply. Procuring, advertising or spreading word so that deposit accounts, electronic cards or e-money accounts may be bought, sold, rented or lent for use in crime carries two to five years, or 200,000 to 500,000 baht, or both. Note that this one has a floor, where section 9 has only a ceiling. Section 11 puts the same range on trading mobile numbers that are registered to someone but whose real user cannot be identified.

Section 11/2 — other people’s identities, including the dead. Added in 2025. Using data that identifies a person or a deceased person, directly or indirectly, to commit technology crime or any other offence: up to a year or 100,000 baht. Collecting, holding or disclosing such data so that it can be used that way: the same. And where it is done by buying, offering to buy, selling, offering to sell, exchanging or otherwise seeking an unlawful benefit: up to five years or 500,000 baht. That is the data-brokerage provision, and the explicit inclusion of the deceased tells you what the drafters had been seeing.

The scam you meet is not the scam that takes the money

The Royal Thai Police publish weekly figures through their anti-online-scam centre, and the shape of them is more useful than the totals.

Roughly four hundred cases out of five and a half thousand did more financial damage than the four thousand seven hundred shopping cases. The distribution is inverted: what you will actually encounter is somebody not sending a phone case, and what will actually hurt is a phone call.

That second category is the one a foreign resident is most exposed to, and not because of gullibility. Impersonation works by attaching itself to a real relationship you cannot easily verify. A call about your visa status, a parcel held at customs, a problem with your bank account or a police matter is entirely plausible when you genuinely do have a visa you do not fully understand, parcels arriving from abroad, an account with rules you have never read, and no idea what a Thai police officer’s phone call would sound like. The scam is not aimed at your judgement. It is aimed at the gap between you and the system.

Which suggests one durable rule rather than a list of red flags. No Thai institution — not immigration, not the police, not your bank, not the anti-scam centre — needs you to resolve anything in the course of an inbound phone call. If the caller is real, hanging up and calling the published number yourself costs you nothing. If the caller is not real, that single habit defeats the entire category, and it does so without your having to be able to spot anything.

Questions people actually ask

How fast do I have to act?

Tell the bank immediately — the suspension propagates down the whole transfer chain, so hours matter — and complain within seventy-two hours. A report to the operations centre counts as the complaint.

Can I report it in Bangkok if I was scammed while I was elsewhere in Thailand?

Yes. Section 8 lets you complain at any station in the Kingdom, or to the Cyber Crime Investigation Bureau, or electronically, and the officer who takes it is the responsible investigator wherever the offence happened.

My account was frozen and nobody has told me anything for two weeks.

If it is a section 6 freeze, official silence is supposed to end it: the fourth paragraph requires the institution to lift the suspension where no result is reported after the period. If it is a section 4/2 listing, no clock applies and it lasts until the listing is revoked. Establishing which one it is is the first task.

Is my account frozen because of the decree, or because of my paperwork?

Those are two different systems. Stale passport, visa or address records get accounts blocked routinely and are fixed at a branch. A decree suspension is about money that passed through, and the published route for an innocent holder is 1441, option 2.

Why won’t the bank tell me who complained?

Section 12 puts data handled under the decree outside the personal data protection law and bars passing it to anyone without a related duty. The information flows sideways between institutions more freely than it flows to you.

Will I get the money back?

There is now a route that does not need a lawsuit: the Anti-Money Laundering Office gazettes the account, victims claim within ninety days, and the Transaction Committee can order a refund, with thirty days to take it to the Civil Court. Whether it reaches you depends on whether the money was still there.

A friend asked to use my account for one transfer. Is that a problem?

Potentially a three-year one. Section 9 covers allowing another person to use your account — or your mobile number — where you know or ought to know it will be used for crime.

Someone called saying they were from the anti-scam hotline.

Thailand’s official anti-fake-news centre has warned that criminals impersonate 1441. Hang up and dial it yourself.

How we made this