Stop fake support calls, malicious app requests and payment redirection before they become account access. Use independently verified channels and report the exact exposure when something goes wrong.
An urgent instruction is not proof of authority
The Bank of Thailand’s fraud-prevention material describes prevention, detection and response measures. A caller can still impersonate a bank, courier, sports service or government office. Be cautious when the requested action is to transfer money, reveal an OTP, install software or share the screen. End the interaction and open the institution’s known app or verified contact page independently. A number shown on a phone display or a familiar profile picture does not by itself authenticate the person speaking.Avoid installing the attacker’s tool
The Thai government’s report on app protection discusses risky applications obtained through browsers, messages and file managers. A fake refund, parcel or streaming page may try to make installation seem necessary. Do not bypass a device warning because a caller says it is routine. Use the provider’s official installation route and inspect the publisher. Permissions that allow screen observation, accessibility control or remote operation can expose sensitive account activity. A security application does not replace checking where the app came from and why it needs those permissions.
Match the response to the exposure
| What happened | Immediate priority | Record |
|---|---|---|
| Received suspicious message only | Do not follow its instructions | Sender and URL |
| Entered a password | Change it from a trusted device and review sessions | Affected account and time |
| Shared an OTP | Contact the affected provider promptly | Code purpose if known, never the code publicly |
| Installed remote-access or suspicious software | Stop sensitive use of that device; seek trusted assistance | App name and permissions |
| Money transferred | Contact the financial provider immediately | Reference, amount, recipient and time |
Keep payment verification independent
Before a transfer, compare the recipient and amount with the original invoice or a separately confirmed request. If a message announces a new bank account, contact the organisation using an existing trusted number. Do not approve a small “verification payment” merely to prove identity to a caller. For family requests, use a previously agreed independent check rather than trusting a voice recording alone. Stop if the caller insists that you must remain on the phone while opening banking screens or prevents you from contacting the bank yourself.
Protective checklist
- Use unique account passwords and available strong authentication.
- Keep the operating system and trusted apps updated.
- Review app permissions and linked account devices.
- Do not disclose PINs, passwords or one-time codes.
- Keep official support contacts accessible on another device.
- Report unauthorised activity with a clear timeline and transaction references.
The BOT official contact page and ETDA consumer-support information help identify genuine institutions. A fake account offering recovery in comments under a complaint is not made trustworthy by using the same agency name.
Recovery without a second loss
Tell the provider whether you merely opened a page, entered credentials, installed an app or authorised a transfer. The distinction changes the protective steps. Keep relevant evidence privately, but do not continue interacting with the suspected attacker to gather more. Do not pay an advance “release fee” to recover a loss or send identity documents to an unsolicited contact. A complaint and a protective account restriction are different actions, and reimbursement is not automatic. Confirm the outcome in the account and keep the written case response.
Example: a fake operator asks for screen sharing
A caller claims that a mobile-number problem will block your banking account and offers to fix it by sharing the screen. End the call and contact the mobile operator independently. If your line still works, check the operator’s official account status; if it does not, use another trusted phone or an official shop. Separately contact the bank if there is an actual account alert. Do not let the caller combine two different services into one emergency that prevents verification. If remote access was already granted, tell the bank and seek trusted device assistance. A genuine service problem can coexist with a fraudulent call, so the existence of one does not authenticate the other.
Frequently asked questions
Is a familiar caller ID enough?
No. Independently contact the institution through its verified app or website.
What if I installed an app for a supposed refund?
Stop sensitive use of the device, contact affected providers through a trusted device and seek qualified assistance.
Can an online recovery agent guarantee my money back?
Do not trust that promise. Use the original provider and appropriate official reporting routes without disclosing credentials.
Sources and verification
- Financial fraud prevention measures — Bank of Thailand — 2026-10-23
- Protection against risky sideloaded apps — Thailand Government Public Relations Department — 2026-10-23
- Bank of Thailand contact information — Bank of Thailand — 2026-10-23
- 1212 ETDA online consumer protection — ETDA — 2026-10-23